Overview

overview

4

Static

static

1

R-U-Dead-Yet.zip

macos-10.15-amd64

1

R-U-Dead-Y...tar.gz

macos-10.15-amd64

1

R-U-Dead-Yet.tar

macos-10.15-amd64

4

BeautifulSoup.py

macos-10.15-amd64

1

README.txt

macos-10.15-amd64

rudeadyet.conf

macos-10.15-amd64

4

socks.py

macos-10.15-amd64

4

R-U-Dead-Y...tar.gz

macos-10.15-amd64

4

R-U-Dead-Yet-v2.1.tar

macos-10.15-amd64

1

BeautifulSoup.py

macos-10.15-amd64

4

README.txt

macos-10.15-amd64

4

rudeadyet.conf

macos-10.15-amd64

1

socks.py

macos-10.15-amd64

4

R-U-Dead-Yet.tar.gz

macos-10.15-amd64

R-U-Dead-Yet.tar

macos-10.15-amd64

1

r-u-dead-y...oup.py

macos-10.15-amd64

4

r-u-dead-y...ME.txt

macos-10.15-amd64

1

r-u-dead-y...t.conf

macos-10.15-amd64

4

r-u-dead-y...tar.gz

macos-10.15-amd64

1

r-u-dead-yet-v2.2.tar

macos-10.15-amd64

rudy/BeautifulSoup.py

macos-10.15-amd64

1

rudy/README

macos-10.15-amd64

4

rudy/rudeadyet.conf

macos-10.15-amd64

4

rudy/socks.py

macos-10.15-amd64

1

Analysis

  • max time kernel
    80s
  • max time network
    125s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240611-en
  • resource tags

    arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    08/07/2024, 13:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    R-U-Dead-Yet-v2.1.tar.gz

  • Size

    28KB

  • MD5

    8575606ea2b1fea175d5634ccb0acf54

  • SHA1

    d2b4fed37dbe442123a37f5b026b16fd6c699b12

  • SHA256

    a9986844f6a662337e1caffbe30956fb6db09d2fb81a99ef039d19f99c946275

  • SHA512

    7556a181b88d04d3c1884b18e7f02e2ea44b07552c4c698f1e0cba7368a0a2833276d756598832054d2b95775f325ca9326000ecd7634780466d6bd40eda85b1

  • SSDEEP

    768:+xAkENS8D2L2oQ6fKzl2QayXLoWoiQid/Qorb:+itNvV6fKz0QaWUxRiV33

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/R-U-Dead-Yet-v2.1.tar.gz\""
    1⤵
      PID:521
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/R-U-Dead-Yet-v2.1.tar.gz\""
      1⤵
        PID:521
      • /usr/libexec/xpcproxy
        xpcproxy com.apple.var-db-dslocal-backup
        1⤵
          PID:522
        • /usr/bin/xar
          /usr/bin/xar -c -f dslocal-backup.xar dslocal
          1⤵
            PID:522
          • /usr/bin/sudo
            sudo /bin/zsh -c /Users/run/R-U-Dead-Yet-v2.1.tar.gz
            1⤵
              PID:521
              • /bin/zsh
                /bin/zsh -c /Users/run/R-U-Dead-Yet-v2.1.tar.gz
                2⤵
                  PID:532
                • /Users/run/R-U-Dead-Yet-v2.1.tar.gz
                  /Users/run/R-U-Dead-Yet-v2.1.tar.gz
                  2⤵
                    PID:532
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.logkextloadsd
                  1⤵
                    PID:523
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.pluginkit.pkreporter
                    1⤵
                      PID:524
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.bsd.dirhelper
                      1⤵
                        PID:525
                      • /usr/libexec/pkreporter
                        /usr/libexec/pkreporter
                        1⤵
                          PID:524
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.gkreport
                          1⤵
                            PID:526
                          • /usr/libexec/gkreport
                            /usr/libexec/gkreport
                            1⤵
                              PID:526
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
                              1⤵
                                PID:527
                              • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                                /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                                1⤵
                                  PID:527
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.systemstats.daily
                                  1⤵
                                    PID:528
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.oracle.java.Java-Updater
                                    1⤵
                                      PID:531
                                    • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                                      "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                                      1⤵
                                        PID:531
                                      • /usr/bin/pluginkit
                                        /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                                        1⤵
                                          PID:569
                                        • /usr/sbin/spctl
                                          /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterBCBF2C69/OneDrive.app
                                          1⤵
                                            PID:570

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads