Analysis
-
max time kernel
132s -
max time network
138s -
platform
macos-10.15_amd64 -
resource
macos-20240410-en -
resource tags
arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
08-06-2024 16:16
Behavioral task
behavioral1
Sample
Electric.rar
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
Electric.rar
Resource
macos-20240410-en
General
-
Target
Electric.rar
-
Size
37.9MB
-
MD5
ed01b80849a848fc3c1285abb66cba4c
-
SHA1
23cc1b1f8dad47f86dabf71110f6ebfe9c854c12
-
SHA256
fd0544bdeb691b88a388b2a51da072c4de37b5f7d9af2a1948d45aed755a80a2
-
SHA512
5e0d254690d7f13bf783e905c2481d73ba570fc623d4af4038b3c75fd4e09f45a3185357403d91b4b1d1d4a59ce03b37571b9383b296f5490eba240d690c1853
-
SSDEEP
786432:Hh5fSYddhTmrs+5ofByRhgYykOF0InSVgEI2/GfEDP6hgkmrvBmYLXWCi:BVSYzhqw2o5J6ISVgEvYo6hgk+fLXWB
Malware Config
Signatures
-
Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes:
ioc process "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
Processes
-
/usr/libexec/xpcproxyxpcproxy com.oracle.java.Java-Updater1⤵PID:486
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Electric.rar\""1⤵PID:487
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Electric.rar\""1⤵PID:487
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Electric.rar1⤵PID:487
-
/bin/zsh/bin/zsh -c /Users/run/Electric.rar2⤵PID:489
-
/Users/run/Electric.rar/Users/run/Electric.rar2⤵PID:489
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck1⤵PID:486
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:493
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterB516C108/OneDrive.app1⤵PID:494
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:515
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:515
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵PID:532
-
/usr/libexec/xpcproxyxpcproxy com.apple.pbs1⤵PID:537
-
/System/Library/CoreServices/pbs/System/Library/CoreServices/pbs1⤵PID:537
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:546
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:547