274086842325654e8c2e2f756629b4fc3532d2b54cbcea3ab207b23782fa56a7

General

Target

Elektroingenirers/Sabbatters.app
Size

1KB
MD5

6d05f4d490578ac56f35a2fb0fdc48c3
SHA1

98cbe66769dca00383a1e6345a0af8d8f5158802
SHA256

68c60b54d23a7eac7decbd381934147857868b1b5f14a5087cc7d691f68670d6
SHA512

0d038240e209b7b478d66800c76668fe40b10ffca149b1920946fb025ba5f1be9f20cd75e689cae6c9e5d9c2f722bf54b5bc2783602a0379def34be48e6753b5

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
evasion

Resource Forking
T1564.009

Processes:

ioc process

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

ioc	process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Users/run/Elektroingenirers/Sabbatters.app\""
1⤵
PID:562

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Users/run/Elektroingenirers/Sabbatters.app\""
1⤵
PID:562

/usr/bin/sudo
sudo /bin/zsh -c "open /Users/run/Elektroingenirers/Sabbatters.app"
1⤵
PID:562

/bin/zsh
/bin/zsh -c "open /Users/run/Elektroingenirers/Sabbatters.app"
2⤵
PID:563

/usr/bin/open
open /Users/run/Elektroingenirers/Sabbatters.app
2⤵
PID:563

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:587

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:589

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:592

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:603

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:604

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:605

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:609

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:610

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:611

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:612

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:613

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:614

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:615

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:622

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:627

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:627

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
89e215322dcba48c6daffb66c6a0d011

SHA1
6c3c6a5e45e767596bf3ca4b024df0913cea398d

SHA256
7819b62d0e9ffba6e8ab2f0a4b1ec54a255968ef34b6cad6088e9c47223a5fcd

SHA512
951cb2001974965e1bc1ab86b7265ebd99b1f7c61e7269b979d7516ace3df2de795aa7cbef28f67da35cdf77536be10729bd4a09eb496eb453fe159e6148de47

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
089215e5cf040cea7ec004134b65667f

SHA1
d0cd4ccecca426239b1f07b865be78bfbd9eadaa

SHA256
602b1f2a97f579f3af360f8bf1dd4d1edd8960244bebba873f9592c4b02fd6e9

SHA512
b225f9e8480967d085aa198dbaddb5fce8d83029902e2831449d0a5f967a48bef9b638366127b06eeeb50a176f48edbb51c6e5c76ace2b0fb1933e848b36a4f8

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1281.xml

Filesize
175KB

MD5
4b83b8564ef37e681421517132a79483

SHA1
c53490db81ccdf4012fc0a184cb6bed56d2fde3c

SHA256
49ee8902d335eaa69e7a62b890f8f49d776187965315cc8a628b2530e50418ff

SHA512
107ec81b0d99c3c02836bce271a16fe3cb86da2fc191090da10de548b9ec0b6731eb4c4d293a62810acd5f9e9ffc4511278d187aff26cc2c21ae338aefb5ca67

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit

Analysis

Sharing