Analysis
-
max time kernel
11s -
max time network
14s -
platform
macos-10.15_amd64 -
resource
macos-20240611-en -
resource tags
arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
16-06-2024 17:16
Static task
static1
Behavioral task
behavioral1
Sample
Contents/Frameworks/libdownload.dylib
Resource
macos-20240611-en
Behavioral task
behavioral2
Sample
Contents/MacOS/Installer
Resource
macos-20240611-en
Behavioral task
behavioral3
Sample
Contents/Resources/install.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral4
Sample
Contents/Resources/install.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral5
Sample
Contents/Resources/install.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral6
Sample
Contents/Resources/install.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
Contents/Frameworks/libdownload.dylib
-
Size
3.2MB
-
MD5
a021b711536465cacf874d88b84902c6
-
SHA1
7ea7fb5681e2a5f40b56bd061901dadd07a03cf9
-
SHA256
2bc4d58a23ab75138202fbc35c667c043ee830e5c17af3f895d1ba00eef1b95d
-
SHA512
84891e099d9818d9f4c4a29fe73c3c3228766e07f611201e1965a5c493ba94c59782d49af3946e9aa94501683827f2e67e35cce7e2270fcebb502208a5cc8d43
-
SSDEEP
98304:pPI6jaAoYfmj+nvl865LTCXF6dXde1EmF8E9WL62eJUP:GGQGs6dtcEmF8E9WL62eJUP
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Contents/Frameworks/libdownload.dylib\""1⤵PID:532
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Contents/Frameworks/libdownload.dylib\""1⤵PID:532
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Contents/Frameworks/libdownload.dylib1⤵PID:532
-
/bin/zsh/bin/zsh -c /Users/run/Contents/Frameworks/libdownload.dylib2⤵PID:533
-
/Users/run/Contents/Frameworks/libdownload.dylib/Users/run/Contents/Frameworks/libdownload.dylib2⤵PID:533
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:537
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterBCBF2C69/OneDrive.app1⤵PID:538