Overview

overview

4

Static

static

1

flutter_premio.png

macos-10.15-amd64

4

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240410-en
  • resource tags

    arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    20/05/2024, 02:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    flutter_premio.png

  • Size

    176KB

  • MD5

    056b12df91208a9a7a3b2c4cf5c6288b

  • SHA1

    49006615e4acef4c1728d6a4cfe8bcf8475ee309

  • SHA256

    5b78258b3bc292fc902672108bcfa721360c2bd38f75265d8ca71a9a4a7b6e44

  • SHA512

    533fa84d6bb552de795ab4e5340a9bfa1bf48fc323be3526e688db1f8cf17a1ff3b717b416bd95f10ba0420088ff750ba07a8473da360fe01a991e5cb3fe2c86

  • SSDEEP

    3072:+SmVclVrnT1IieC0golpxCHN7BTtNmuv4v6fHEKhUnCgGTsAiYIxsPA:+SmVclhnTledgoXE7TC6fkKheCgchIao

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 3 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /usr/libexec/xpcproxy
    xpcproxy com.apple.gkreport
    1⤵
      PID:480
    • /usr/libexec/gkreport
      /usr/libexec/gkreport
      1⤵
        PID:480
      • /bin/sh
        sh -c "sudo /bin/zsh -c \"/Users/run/flutter_premio.png\""
        1⤵
          PID:481
        • /bin/bash
          sh -c "sudo /bin/zsh -c \"/Users/run/flutter_premio.png\""
          1⤵
            PID:481
          • /usr/bin/sudo
            sudo /bin/zsh -c /Users/run/flutter_premio.png
            1⤵
              PID:481
              • /bin/zsh
                /bin/zsh -c /Users/run/flutter_premio.png
                2⤵
                  PID:486
                • /Users/run/flutter_premio.png
                  /Users/run/flutter_premio.png
                  2⤵
                    PID:486
                • /usr/libexec/xpcproxy
                  xpcproxy com.oracle.java.Java-Updater
                  1⤵
                    PID:482
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.systemstats.daily
                    1⤵
                      PID:483
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.newsyslog
                      1⤵
                        PID:484
                      • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                        "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                        1⤵
                          PID:482
                        • /usr/sbin/newsyslog
                          /usr/sbin/newsyslog
                          1⤵
                            PID:484
                          • /usr/bin/pluginkit
                            /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                            1⤵
                              PID:489
                            • /usr/sbin/spctl
                              /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater0BF23177/OneDrive.app
                              1⤵
                                PID:490
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.AppStore.1900
                                1⤵
                                  PID:532
                                • /System/Applications/App Store.app/Contents/MacOS/App Store
                                  "/System/Applications/App Store.app/Contents/MacOS/App Store"
                                  1⤵
                                    PID:532
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.storeuid
                                    1⤵
                                      PID:533
                                    • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
                                      /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
                                      1⤵
                                        PID:533
                                      • /usr/libexec/xpcproxy
                                        xpcproxy com.apple.rtcreportingd
                                        1⤵
                                          PID:536
                                        • /usr/libexec/rtcreportingd
                                          /usr/libexec/rtcreportingd
                                          1⤵
                                            PID:536
                                          • /usr/libexec/xpcproxy
                                            xpcproxy com.apple.coremedia.videodecoder 532
                                            1⤵
                                              PID:537
                                            • /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
                                              /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
                                              1⤵
                                                PID:537
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.accessibility.mediaaccessibilityd
                                                1⤵
                                                  PID:538
                                                • /System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
                                                  /System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
                                                  1⤵
                                                    PID:538
                                                  • /usr/libexec/xpcproxy
                                                    xpcproxy com.apple.FaceTime.1860
                                                    1⤵
                                                      PID:540
                                                    • /System/Applications/FaceTime.app/Contents/MacOS/FaceTime
                                                      /System/Applications/FaceTime.app/Contents/MacOS/FaceTime
                                                      1⤵
                                                        PID:540
                                                      • /usr/libexec/xpcproxy
                                                        xpcproxy com.apple.videoconference.camera
                                                        1⤵
                                                          PID:541
                                                        • /usr/libexec/avconferenced
                                                          /usr/libexec/avconferenced
                                                          1⤵
                                                            PID:541
                                                          • /usr/libexec/xpcproxy
                                                            xpcproxy com.apple.FaceTime.FaceTimeNotificationCenterService 540
                                                            1⤵
                                                              PID:542
                                                            • /System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService
                                                              /System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService
                                                              1⤵
                                                                PID:542
                                                              • /usr/libexec/xpcproxy
                                                                xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 540
                                                                1⤵
                                                                  PID:544
                                                                • /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
                                                                  /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
                                                                  1⤵
                                                                    PID:544
                                                                  • /usr/libexec/xpcproxy
                                                                    xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 541
                                                                    1⤵
                                                                      PID:545
                                                                    • /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
                                                                      /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
                                                                      1⤵
                                                                        PID:545
                                                                      • /usr/libexec/xpcproxy
                                                                        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                                        1⤵
                                                                          PID:546
                                                                        • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                          /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                          1⤵
                                                                            PID:546
                                                                          • /usr/libexec/xpcproxy
                                                                            xpcproxy com.apple.PerformanceAnalysis.animationperfd
                                                                            1⤵
                                                                              PID:547
                                                                            • /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                              /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                              1⤵
                                                                                PID:547
                                                                              • /usr/libexec/xpcproxy
                                                                                xpcproxy com.apple.spindump
                                                                                1⤵
                                                                                  PID:550
                                                                                • /usr/sbin/spindump
                                                                                  /usr/sbin/spindump
                                                                                  1⤵
                                                                                    PID:550
                                                                                  • /usr/libexec/xpcproxy
                                                                                    xpcproxy com.apple.spindump_agent
                                                                                    1⤵
                                                                                      PID:551
                                                                                    • /usr/libexec/spindump_agent
                                                                                      /usr/libexec/spindump_agent
                                                                                      1⤵
                                                                                        PID:551
                                                                                      • /usr/libexec/xpcproxy
                                                                                        xpcproxy com.apple.storedownloadd
                                                                                        1⤵
                                                                                          PID:552
                                                                                        • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                                                                          /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                                                                          1⤵
                                                                                            PID:552
                                                                                          • /usr/libexec/xpcproxy
                                                                                            xpcproxy com.apple.ReportMemoryException
                                                                                            1⤵
                                                                                              PID:553
                                                                                            • /usr/libexec/ReportMemoryException
                                                                                              /usr/libexec/ReportMemoryException
                                                                                              1⤵
                                                                                                PID:553
                                                                                              • /usr/libexec/xpcproxy
                                                                                                xpcproxy com.apple.WebKit.WebContent.10568623-B5CA-457E-A2F8-56D37572E41B 532
                                                                                                1⤵
                                                                                                  PID:554
                                                                                                • /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                                                                  /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                                                                  1⤵
                                                                                                    PID:554
                                                                                                  • /usr/libexec/xpcproxy
                                                                                                    xpcproxy com.apple.Safari.SafeBrowsing.Service
                                                                                                    1⤵
                                                                                                      PID:556
                                                                                                    • /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
                                                                                                      /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
                                                                                                      1⤵
                                                                                                        PID:556

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • /Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist
                                                                                                        Filesize

                                                                                                        676B

                                                                                                        MD5

                                                                                                        4a571037dd52798c15fce25ae6a17315

                                                                                                        SHA1

                                                                                                        955663200c9a1b0f11d1da99e8c8e7e6aea92127

                                                                                                        SHA256

                                                                                                        3174def8ef77f4aab471fdfa7ee3ea6a0661b7f8ef421c0d4a84afaf777cdbb9

                                                                                                        SHA512

                                                                                                        840d72d69e281576d160521d825e1cfb40dbf46de1f00f95c469538723e3876c1b45741da5010aa15a5f2d4fead0569c763402e594eeb1c79f6cefc0967cadba

                                                                                                        Download Submit

                                                                                                      • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.AppStore//mds/mdsDirectory.db
                                                                                                        Filesize

                                                                                                        47KB

                                                                                                        MD5

                                                                                                        0e4a0d1ceb2af6f0f8d0167ce77be2d3

                                                                                                        SHA1

                                                                                                        414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

                                                                                                        SHA256

                                                                                                        cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

                                                                                                        SHA512

                                                                                                        1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

                                                                                                        Download Submit

                                                                                                      • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.AppStore//mds/mdsObject.db
                                                                                                        Filesize

                                                                                                        4KB

                                                                                                        MD5

                                                                                                        d3a1859e6ec593505cc882e6def48fc8

                                                                                                        SHA1

                                                                                                        f8e6728e3e9de477a75706faa95cead9ce13cb32

                                                                                                        SHA256

                                                                                                        3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

                                                                                                        SHA512

                                                                                                        ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

                                                                                                        Download Submit

                                                                                                      • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
                                                                                                        Filesize

                                                                                                        222KB

                                                                                                        MD5

                                                                                                        9a4878f124029a91ac39473b3d85a943

                                                                                                        SHA1

                                                                                                        5ecf99716a0162aaad8ef5e8310a386c8b04dd83

                                                                                                        SHA256

                                                                                                        0f17405cd15ac2329cdfdbb15a8a7072d2809e6fb3fdf0c70583dc4b1780c556

                                                                                                        SHA512

                                                                                                        52ce3e8500925eee4d175227c90357c34c06deddae8f805fab840d867d3acd6d4719990879e837811086b9e566a085cf74e806f346697d5b298a3351c709f1fe

                                                                                                        Download Submit

                                                                                                      • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
                                                                                                        Filesize

                                                                                                        22.0MB

                                                                                                        MD5

                                                                                                        abafb2234358db4dbb871ce3625af642

                                                                                                        SHA1

                                                                                                        c22ea55e478dc5c5a299d6cc0fcef48f37707ffe

                                                                                                        SHA256

                                                                                                        c6dcb6f676a5258dbcf00df94b870976837d1200610a04ec6ed91c5406c26e4a

                                                                                                        SHA512

                                                                                                        b9cde21644b6607fb1ac5c2938208de848d9aa843384f01dd6f1e09ab8b3d030f65cb9172efb569341f7fe2ba7387039ab70ff343cdb2d7e5b8cc822244a2712

                                                                                                        Download Submit

                                                                                                      • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
                                                                                                        Filesize

                                                                                                        124KB

                                                                                                        MD5

                                                                                                        523163965bb2f6f0da08bf26594b302b

                                                                                                        SHA1

                                                                                                        f3290cab1220b9c3f216930f9068704489a785a9

                                                                                                        SHA256

                                                                                                        693cc46febe99913c7cec73513b206d72f22de0db2c613619b9c769d76430388

                                                                                                        SHA512

                                                                                                        c8fce7ada0da15139e3e60e1308c767777d5189052a7260ee50cfde29eb57743f87fae23cacb1e01d7a3b252c39f7686f9455d6b2494b56f9c3408fda699e6ad

                                                                                                        Download Submit