Overview

overview

8

Static

static

1

360TS_Setup_Mini.exe

windows11-21h2-x64

8

360TS_Setup_Mini.exe

android-13-x64

360TS_Setup_Mini.exe

macos-10.15-amd64

4

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    18-05-2024 19:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    360TS_Setup_Mini.exe

  • Size

    1.4MB

  • MD5

    31fee2c73b8d2a8ec979775cd5f5ced7

  • SHA1

    39182a68bc0c1c07d3ddc47cd69fe3692dbac834

  • SHA256

    d26a7f2d4f3521827201e6cdcd296f132c7d18c3a1ce70c24b423300cff326fe

  • SHA512

    db51b602a8675641bc3a0a980a197243787ed12f5e0619cb1d390c91193d7e3447e3e86e2321c3ea273c6732b356003a249241d7d8a5699931810e5a35d5c650

  • SSDEEP

    24576:kL/7n6lbcC8oblv1zj1SqdAGFQZIxvC45UJoe1Z:E6+C8o5tzjYq+ZIxL5UJoeL

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /usr/libexec/xpcproxy
    xpcproxy com.apple.var-db-dslocal-backup
    1⤵
      PID:477
    • /usr/libexec/xpcproxy
      xpcproxy com.oracle.java.Java-Updater
      1⤵
        PID:478
      • /usr/bin/xar
        /usr/bin/xar -c -f dslocal-backup.xar dslocal
        1⤵
          PID:477
        • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
          "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
          1⤵
            PID:478
          • /usr/libexec/xpcproxy
            xpcproxy com.apple.gkreport
            1⤵
              PID:480
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.systemstats.daily
              1⤵
                PID:481
              • /usr/libexec/gkreport
                /usr/libexec/gkreport
                1⤵
                  PID:480
                • /bin/sh
                  sh -c "sudo /bin/zsh -c \"/Users/run/360TS_Setup_Mini.exe\""
                  1⤵
                    PID:482
                  • /bin/bash
                    sh -c "sudo /bin/zsh -c \"/Users/run/360TS_Setup_Mini.exe\""
                    1⤵
                      PID:482
                    • /usr/bin/sudo
                      sudo /bin/zsh -c /Users/run/360TS_Setup_Mini.exe
                      1⤵
                        PID:482
                        • /bin/zsh
                          /bin/zsh -c /Users/run/360TS_Setup_Mini.exe
                          2⤵
                            PID:484
                          • /Users/run/360TS_Setup_Mini.exe
                            /Users/run/360TS_Setup_Mini.exe
                            2⤵
                              PID:484
                          • /usr/sbin/spctl
                            /usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
                            1⤵
                              PID:525
                            • /bin/launchctl
                              /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                              1⤵
                                PID:532
                              • /bin/launchctl
                                /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                                1⤵
                                  PID:533
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                  1⤵
                                    PID:538
                                  • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                    /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                    1⤵
                                      PID:538

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads