Overview

overview

4

Static

static

1

R-U-Dead-Yet.zip

macos-10.15-amd64

1

R-U-Dead-Y...tar.gz

macos-10.15-amd64

1

R-U-Dead-Yet.tar

macos-10.15-amd64

4

BeautifulSoup.py

macos-10.15-amd64

1

README.txt

macos-10.15-amd64

rudeadyet.conf

macos-10.15-amd64

4

socks.py

macos-10.15-amd64

4

R-U-Dead-Y...tar.gz

macos-10.15-amd64

4

R-U-Dead-Yet-v2.1.tar

macos-10.15-amd64

1

BeautifulSoup.py

macos-10.15-amd64

4

README.txt

macos-10.15-amd64

4

rudeadyet.conf

macos-10.15-amd64

1

socks.py

macos-10.15-amd64

4

R-U-Dead-Yet.tar.gz

macos-10.15-amd64

R-U-Dead-Yet.tar

macos-10.15-amd64

1

r-u-dead-y...oup.py

macos-10.15-amd64

4

r-u-dead-y...ME.txt

macos-10.15-amd64

1

r-u-dead-y...t.conf

macos-10.15-amd64

4

r-u-dead-y...tar.gz

macos-10.15-amd64

1

r-u-dead-yet-v2.2.tar

macos-10.15-amd64

rudy/BeautifulSoup.py

macos-10.15-amd64

1

rudy/README

macos-10.15-amd64

4

rudy/rudeadyet.conf

macos-10.15-amd64

4

rudy/socks.py

macos-10.15-amd64

1

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240611-en
  • resource tags

    arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    08/07/2024, 13:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    socks.py

  • Size

    13KB

  • MD5

    e702da50ad4c5f0fc7f5520e7bdbaa99

  • SHA1

    3a900a380e4e4cefb92c00da4d6e77b53ac9f1ae

  • SHA256

    c8a1556ae306eb4e0d1ae7f7948b220646e1e341637e974becc560609424a12b

  • SHA512

    eb98780191c4993c312f6f3b544998ab566a86af68ec426070a255f832c7ac534b0937d1e7330ebaf3998316d076417056a1f2ddae2798fb19082a550ec56a64

  • SSDEEP

    384:yrNraKf1sFI0XT0DoKJlSZFsPbM//8NOTn2TxVQPL1IZI:yTf1sFXXT0MKJlQFsPbM//8NOTSxePLp

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/socks.py\""
    1⤵
      PID:553
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/socks.py\""
      1⤵
        PID:553
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/socks.py
        1⤵
          PID:553
          • /bin/zsh
            /bin/zsh -c /Users/run/socks.py
            2⤵
              PID:554
            • /Users/run/socks.py
              /Users/run/socks.py
              2⤵
                PID:554
              • /bin/sh
                sh /Users/run/socks.py
                2⤵
                  PID:554
                • /bin/bash
                  sh /Users/run/socks.py
                  2⤵
                    PID:554
                    • SocksiPy - Python SOCKS module. Version 1.00 Copyright 2006 Dan-Haim. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name of Dan Haim nor the names of his contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY DAN HAIM AS
                      "SocksiPy - Python SOCKS module. Version 1.00 Copyright 2006 Dan-Haim. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name of Dan Haim nor the names of his contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY DAN HAIM AS" "IS AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAN HAIM OR HIS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMANGE. This module provides a standard socket-like interface for Python for tunneling connections through SOCKS proxies. "
                      3⤵
                        PID:555
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.sysmond
                    1⤵
                      PID:572
                    • /usr/libexec/sysmond
                      /usr/libexec/sysmond
                      1⤵
                        PID:572
                      • /usr/libexec/xpcproxy
                        xpcproxy com.apple.security.cloudkeychainproxy3
                        1⤵
                          PID:579
                        • /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                          /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                          1⤵
                            PID:579
                          • /usr/bin/pluginkit
                            /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                            1⤵
                              PID:603
                            • /usr/sbin/spctl
                              /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2E18A62F/OneDrive.app
                              1⤵
                                PID:604
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.geod
                                1⤵
                                  PID:608
                                • /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                  /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                  1⤵
                                    PID:608
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.AddressBook.ContactsAccountsService
                                    1⤵
                                      PID:615
                                    • /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
                                      /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
                                      1⤵
                                        PID:615
                                      • /usr/libexec/xpcproxy
                                        xpcproxy com.apple.suggestd
                                        1⤵
                                          PID:616
                                        • /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
                                          /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
                                          1⤵
                                            PID:616
                                          • /usr/libexec/xpcproxy
                                            xpcproxy com.apple.knowledge-agent
                                            1⤵
                                              PID:618
                                            • /usr/libexec/knowledge-agent
                                              /usr/libexec/knowledge-agent
                                              1⤵
                                                PID:618
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.routined
                                                1⤵
                                                  PID:620
                                                • /usr/libexec/routined
                                                  /usr/libexec/routined LAUNCHED_BY_LAUNCHD
                                                  1⤵
                                                    PID:620
                                                  • /usr/libexec/xpcproxy
                                                    xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
                                                    1⤵
                                                      PID:622
                                                    • /usr/libexec/neagent
                                                      /usr/libexec/neagent
                                                      1⤵
                                                        PID:622
                                                      • /usr/libexec/xpcproxy
                                                        xpcproxy com.apple.Maps.mapspushd
                                                        1⤵
                                                          PID:623
                                                        • /System/Library/CoreServices/mapspushd
                                                          /System/Library/CoreServices/mapspushd
                                                          1⤵
                                                            PID:623
                                                          • /usr/libexec/xpcproxy
                                                            xpcproxy com.apple.siri.context.service
                                                            1⤵
                                                              PID:624
                                                            • /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
                                                              /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
                                                              1⤵
                                                                PID:624
                                                              • /usr/libexec/xpcproxy
                                                                xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                                1⤵
                                                                  PID:629
                                                                • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                  /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                  1⤵
                                                                    PID:629

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v15

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
                                                                          Filesize

                                                                          124KB

                                                                          MD5

                                                                          d9a032edde13381954a40470815edc61

                                                                          SHA1

                                                                          3dfca25e472834afbf80d56fe7494b449da59518

                                                                          SHA256

                                                                          aa003a554f429559f418886b4068e060dd45e895041d02e2c6b5533f5b14f9f0

                                                                          SHA512

                                                                          8ad0dc5de4dbac3529faf06291b5e8569e4de872497dda5f8b68652af2e0da73183530ce3867e17cde93d9a5cc1bddc36552a5d8f8141595853586c186dadf06

                                                                          Download Submit