Overview
overview
7Static
static
1NetShred_X...NT.dmg
macos-10.15-amd64
1NetShred X...T].dmg
macos-10.15-amd64
7NetShred X.../rhash
macos-10.15-amd64
4NetShred X...perApp
macos-10.15-amd64
1NetShred X...ts.rtf
windows7-x64
4NetShred X...ts.rtf
windows10-2004-x64
1NetShred X...hred X
macos-10.15-amd64
4NetShred X...ts.rtf
windows7-x64
4NetShred X...ts.rtf
windows10-2004-x64
1NetShred X....dylib
macos-10.15-amd64
4NetShred X...qlite3
macos-10.15-amd64
4NetShred X...iendly
ubuntu-18.04-amd64
3NetShred X...iendly
debian-9-armhf
1NetShred X...iendly
debian-9-mips
NetShred X...iendly
debian-9-mipsel
Analysis
-
max time kernel
5s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
11-05-2024 04:19
Static task
static1
Behavioral task
behavioral1
Sample
NetShred_X_6_0_2_TNT.dmg
Resource
macos-20240410-en
Behavioral task
behavioral2
Sample
NetShred X 6.0.2/Manual install/NetShred X 6.0.2 [TNT].dmg
Resource
macos-20240410-en
Behavioral task
behavioral3
Sample
NetShred X 6.0.2/Extra/rhash
Resource
macos-20240410-en
Behavioral task
behavioral4
Sample
NetShred X 6.0.2/NetShred X.app/Contents/Library/LoginItems/LaunchAtLoginHelperApp.app/Contents/MacOS/LaunchAtLoginHelperApp
Resource
macos-20240410-en
Behavioral task
behavioral5
Sample
NetShred X 6.0.2/NetShred X.app/Contents/Library/LoginItems/LaunchAtLoginHelperApp.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
NetShred X 6.0.2/NetShred X.app/Contents/Library/LoginItems/LaunchAtLoginHelperApp.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
NetShred X 6.0.2/NetShred X.app/Contents/MacOS/NetShred X
Resource
macos-20240410-en
Behavioral task
behavioral8
Sample
NetShred X 6.0.2/NetShred X.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win7-20240508-en
Behavioral task
behavioral9
Sample
NetShred X 6.0.2/NetShred X.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
NetShred X 6.0.2/NetShred X.app/Contents/Resources/libConfigurer64.dylib
Resource
macos-20240410-en
Behavioral task
behavioral11
Sample
NetShred X 6.0.2/NetShred X.app/Contents/Resources/sqlite3
Resource
macos-20240410-en
Behavioral task
behavioral12
Sample
NetShred X 6.0.2/Open Gatekeeper friendly
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral13
Sample
NetShred X 6.0.2/Open Gatekeeper friendly
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral14
Sample
NetShred X 6.0.2/Open Gatekeeper friendly
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral15
Sample
NetShred X 6.0.2/Open Gatekeeper friendly
Resource
debian9-mipsel-20240226-en
General
-
Target
NetShred X 6.0.2/Open Gatekeeper friendly
-
Size
1KB
-
MD5
dc9fb0fdb63b80375e7fdd5f67022847
-
SHA1
55437344bde13777a3e309599aa6c7930721d4d7
-
SHA256
45f8b43453cb19232902844bfde4af6471f3762880f23e968bfca28a33c26817
-
SHA512
59f501c0b2843254f97e1c7492c295fd0cb41ca024b92cee617db471ee815aea823969381c95a7ab7a581957e2964673e3e0336ac02233d7dc0392cadae78fd7
Malware Config
Signatures
-
Reads runtime system information 4 IoCs
Reads data from /proc virtual filesystem.
Processes:
mkdircpmkdirfinddescription ioc process File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems cp File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems find -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
cpdescription ioc process File opened for modification /tmp/tnt17775/NetShred X 6.0.2 [TNT].dmg cp
Processes
-
/tmp/NetShred X 6.0.2/Open Gatekeeper friendly"/tmp/NetShred X 6.0.2/Open Gatekeeper friendly"1⤵
-
/usr/bin/clearclear2⤵
-
/usr/bin/dirnamedirname "/tmp/NetShred X 6.0.2/Open Gatekeeper friendly"2⤵
-
/bin/rmrm -rf /tmp/tnt177752⤵
-
/bin/mkdirmkdir -p /tmp/tnt177752⤵
- Reads runtime system information
-
/bin/cpcp "/tmp/NetShred X 6.0.2/Manual install/NetShred X 6.0.2 [TNT].dmg" /tmp/tnt177752⤵
- Reads runtime system information
- Writes file to tmp directory
-
/bin/mkdirmkdir -p /tmp/tnt17775/mount2⤵
- Reads runtime system information
-
/usr/bin/findfind /tmp/tnt17775/mount -maxdepth 1 "!" -type l "!" -path /tmp/tnt17775/mount -exec xattr -r -d com.apple.quarantine "{}" ";"2⤵
- Reads runtime system information
-
/bin/sleepsleep 52⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/tmp/tnt17775/NetShred X 6.0.2 [TNT].dmgFilesize
3.4MB
MD5b4445a1d2526685b24df671313e9417b
SHA1c3b7b3a0ba012a428709695772c187407bf40797
SHA25632d131386d46c189a87ac5425e448cbd9cfb10d1117d0f9084ff7cf3b1d7317b
SHA512f5caf85550caaaeee5bf17992aba5bfac67254a68fc1827b571e4397d9433ec1d495b8ed6cbea8e27b6c3503414ce1dd301be16ca54999aee8a7a2be7ba90f32