Overview
overview
4Static
static
1SteamSetup.exe
macos-10.15-amd64
4$PLUGINSDI...ls.dll
macos-10.15-amd64
1$PLUGINSDI...em.dll
macos-10.15-amd64
1$PLUGINSDI...gs.dll
macos-10.15-amd64
4$PLUGINSDI...ec.dll
macos-10.15-amd64
4$PLUGINSDI...ss.dll
macos-10.15-amd64
1Steam.exe
macos-10.15-amd64
bin/SteamService.exe
macos-10.15-amd64
4uninstall.exe
macos-10.15-amd64
1$PLUGINSDI...LL.dll
macos-10.15-amd64
4$PLUGINSDI...nk.dll
macos-10.15-amd64
4$PLUGINSDI...ec.dll
macos-10.15-amd64
1Analysis
-
max time kernel
56s -
max time network
126s -
platform
macos-10.15_amd64 -
resource
macos-20240611-en -
resource tags
arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
17-06-2024 06:41
Static task
static1
Behavioral task
behavioral1
Sample
SteamSetup.exe
Resource
macos-20240611-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/StdUtils.dll
Resource
macos-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
macos-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
macos-20240611-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
macos-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsProcess.dll
Resource
macos-20240611-en
Behavioral task
behavioral7
Sample
Steam.exe
Resource
macos-20240611-en
Behavioral task
behavioral8
Sample
bin/SteamService.exe
Resource
macos-20240611-en
Behavioral task
behavioral9
Sample
uninstall.exe
Resource
macos-20240611-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
macos-20240611-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ShellLink.dll
Resource
macos-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
macos-20240611-en
General
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
17KB
-
MD5
2095af18c696968208315d4328a2b7fe
-
SHA1
b1b0e70c03724b2941e92c5098cc1fc0f2b51568
-
SHA256
3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
-
SHA512
60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5
-
SSDEEP
384:PbGgezxEqoyGgmkNFNyQH38E9VF6IYinAM+oZhc3iMy8:T31yGLkbMEpYinAMxZAy8
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/\$PLUGINSDIR/nsExec.dll\""1⤵PID:530
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/\$PLUGINSDIR/nsExec.dll\""1⤵PID:530
-
/usr/bin/sudosudo /bin/zsh -c /Users/run//nsExec.dll1⤵PID:530
-
/bin/zsh/bin/zsh -c /Users/run//nsExec.dll2⤵PID:532
-
/Users/run//nsExec.dll/Users/run//nsExec.dll2⤵PID:532
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:566
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterBCBF2C69/OneDrive.app1⤵PID:567