ee2c95d15d1fb522a602beab9292f5045ae98723ba0701628aa45ad9e7faca87

General

Target
worldpainter/WorldPainter Installer.app/Contents/MacOS/JavaApplicationStub
Size 306KB
Sample240603-25wkjsdd25
SHA256 078a13a7563fd257b5ca7733d62e588a1dd3e75d2013b17131487756ace99ca7
MD5 835ea77dbe4d1543d656f48c21608dfe
SHA1 6ae83155ab153cb1b7eca15f1b2822094df2a20c
SHA512 6ddd9a8cf81ebf9a523868cea316178501da30a4f14e8534d9dde9e63f0d46a58efc45e4c42b6cf9804d8f756245443d4fd258c2f30d8e3e8b8cc5efaeb73025
SSDEEP 6144:RUS9fFTYxrmWjJdVE7CfeVPFXYvmE3oS1acOV:RR9AmWvaDVPFXY4
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/worldpainter/WorldPainter Installer.app/Contents/MacOS/JavaApplicationStub\""
1⤵
PID:522

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/worldpainter/WorldPainter Installer.app/Contents/MacOS/JavaApplicationStub\""
1⤵
PID:522

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/worldpainter/WorldPainter Installer.app/Contents/MacOS/JavaApplicationStub"
1⤵
PID:522
- /bin/zsh
  /bin/zsh -c "/Users/run/worldpainter/WorldPainter Installer.app/Contents/MacOS/JavaApplicationStub"
  2⤵
  PID:524
- /Users/run/worldpainter/WorldPainter
  /Users/run/worldpainter/WorldPainter Installer.app/Contents/MacOS/JavaApplicationStub
  2⤵
  PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:526

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:546

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:553

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:554

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:555

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:558

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:559

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:564

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:567

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:568

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:572

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:574

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:583

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:583

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 42B
SHA256 9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1
MD5 ce7f5b3d4bfc7b4b0da6a06dccc515f2
SHA1 ce657a52a052a3aaf534ecfbf7cbdde4ee334c10
SHA512 db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 102B
SHA256 e011a72bbc74022b95a19b372a056dea8fc8a79528ec31ce0187a0192460c842
MD5 41531bfeb1fcaa0616c0cac52bb384d3
SHA1 4c17da98d22bc143f3ce373027ed8c9088a1d35d
SHA512 20ce2edfe1860d8d79350ba8646ec6cf269aaba05f144fd57388c06ddb7db2e8248729c6775932400e3cd07759b4bf99a41bc3b83f17601814214239eb274325
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 147B
SHA256 771c48bb7227928924e6c38fc221854afaa37c93430adcc7666acc601494e889
MD5 5303f7aad334b526983e94d3c60a8e4b
SHA1 8bd985ad720466bdec0ddedc65e650ecde4ca332
SHA512 68b7b31be6ee1f537709860fe84147c6623e2a96d1adc4198b39e0744da81fe8c2c5bc640d5c15fd2ec999f6b79c30b9390771a7be1eeb3e1972b829ec2ba9a7
MD5 SHA1 SHA512

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 6aeb50677f2058d4650cdeee72514a67491c9eb647d6f3e7ab25b83d0d4960a9
MD5 83c4deae5c4f6e485d9ff0f65968c94b
SHA1 74f4b4c3c7129522f5a6e84e292c93b5badd229b
SHA512 b4d3806b8a59115c6c66982c4ea4242cf914da1a90056dfa9d5359a1004172ef4cfdd903e1139a5f8f8fbda88ccd40dd096d19febfa20a58b1d5dc2598141425
SSDEEP 3072:6ZFctGpG1qcOWfykEJc5oslHzn0YgJfTNVCIEODtBv2qzyUI7icNCx2Jc3:6ZFctGpGqcOWl5LlTn0xDtoSv3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Experiments.pbd

Path /Users/run/Library/Caches/GeoServices/Experiments.pbd
Size 137B
SHA256 7edcf940787b69772934b87c8526a38278fb3c81c589e091c06ff607ff6ca1e8
MD5 96012aa2d7951d2cc9ada9f7021f8497
SHA1 8dc577f7310650b465eb2b6d976f3cc1696388e1
SHA512 328fa33be7aa51ebcecf2dda22c0442ad46f3e15e6818c5912037cd1292fc013e4ad0ead8e6da9505485a3920d472b88cd306ad2754c8ad07637973bf1cda68d
MD5 SHA1 SHA512

Submit Download

altitude-1285.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1285.xml
Size 179KB
SHA256 7224f8828694ed74a8353567e4d84da188d15a993a4a75938f8409cb49218e7c
MD5 9a43af57707d2fb460832049d1f217d1
SHA1 056d813f8cb5198ca82072f7e3484f38ea5267f8
SHA512 1f33175f5d0958c79540a627552f71c6960b6ff19c9b2b0aa604c00bfeff216f6ea2ec3a22ef91ad8d7249597fdf5ad49ddbf5f4aef71b397e785152474954d7
SSDEEP 768:SGSaD5wrMhcaOqBhyzi6+tLr2QKtKkvJSgryvYZW/VEu/etKwxml+BVqjWDSr/gm:SGSsSIhyDoV4EReTMJjMkmNB4htWQ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads