e245504834265a0c25e5a45a90fd788081018b97f1fd4e5e8275791cedbe72c0 | Triage

Submit
Reports

Overview

overview

3

Static

static

1

Payload/Ro....dylib

macos-10.15-amd64

1

Payload/Ro...ler.js

windows7-x64

3

Payload/Ro...ler.js

windows10-2004-x64

3

Payload/Ro...ols.js

windows7-x64

3

Payload/Ro...ols.js

windows10-2004-x64

3

Payload/Ro...r.html

windows7-x64

1

Payload/Ro...r.html

windows10-2004-x64

1

Payload/Ro...ension

macos-10.15-amd64

1

Payload/Ro...Roblox

macos-10.15-amd64

1

Payload/Ro...r.html

windows7-x64

1

Payload/Ro...r.html

windows10-2004-x64

1

Payload/Ro...t.html

windows7-x64

1

Payload/Ro...t.html

windows10-2004-x64

1

Payload/Ro...p.html

windows7-x64

1

Payload/Ro...p.html

windows10-2004-x64

1

Analysis

max time kernel
96s
max time network
161s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
14/07/2024, 02:34

Sharing

Static task

static1

Behavioral task

behavioral1

Sample

Payload/Roblox.app/Frameworks/AppleWare.dylib

Resource

macos-20240711.1-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

Payload/Roblox.app/Frameworks/RobloxLib.framework/content/configs/PerformanceConfigs/rofiler.js

Resource

win7-20240708-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

Payload/Roblox.app/Frameworks/RobloxLib.framework/content/configs/PerformanceConfigs/rofiler.js

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral4

Sample

Payload/Roblox.app/Frameworks/RobloxLib.framework/content/configs/PerformanceConfigs/rofiler.tools.js

Resource

win7-20240708-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

Payload/Roblox.app/Frameworks/RobloxLib.framework/content/configs/PerformanceConfigs/rofiler.tools.js

Resource

win10v2004-20240709-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

Payload/Roblox.app/FriendFinderDisclaimer.html

Resource

win7-20240704-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral7

Sample

Payload/Roblox.app/FriendFinderDisclaimer.html

Resource

win10v2004-20240709-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral8

Sample

Payload/Roblox.app/PlugIns/RBNotificationServiceExtension.appex/RBNotificationServiceExtension

Resource

macos-20240711.1-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Payload/Roblox.app/Roblox

Resource

macos-20240711.1-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Payload/Roblox.app/SignUpDisclamer.html

Resource

win7-20240704-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral11

Sample

Payload/Roblox.app/SignUpDisclamer.html

Resource

win10v2004-20240709-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral12

Sample

Payload/Roblox.app/SignUpDisclamerTencent.html

Resource

win7-20240704-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral13

Sample

Payload/Roblox.app/SignUpDisclamerTencent.html

Resource

win10v2004-20240709-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral14

Sample

Payload/Roblox.app/TwoStepCodeHelp.html

Resource

win7-20240704-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral15

Sample

Payload/Roblox.app/TwoStepCodeHelp.html

Resource

win10v2004-20240709-en

windows10-2004-x64

6 signatures

150 seconds

Report Analysis Logs

General

Target

Payload/Roblox.app/Frameworks/AppleWare.dylib
Size

4.2MB
MD5

a2f8be7fb9b72ab29d04e05fcf022d92
SHA1

615ee2469373d01074040d8fdd0a46fb677d55b9
SHA256

58c550ef9ec5852b416e3d26e5c2b740f92dd873d4edacc5415974e095cf8e7b
SHA512

c53f9386c27f293115e11bc1d356c3bd35b178068dc3867a3d97cf0fe51539c59d08c13c04b00cab84a881e98794eb8c2dd5885d6d2fd0eed435af20dcfc8eec
SSDEEP

98304:TAOSaohYrBktoB6kgGQPWdhjVtwLgi+884:T/pHMnH8

Score

1^/10

Malware Config

Signatures

Processes

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/Roblox.app/Frameworks/AppleWare.dylib\""
1⤵
PID:503

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/Roblox.app/Frameworks/AppleWare.dylib\""
1⤵
PID:503

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Payload/Roblox.app/Frameworks/AppleWare.dylib
1⤵
PID:503
- /bin/zsh
  /bin/zsh -c /Users/run/Payload/Roblox.app/Frameworks/AppleWare.dylib
  2⤵
  PID:504
- /Users/run/Payload/Roblox.app/Frameworks/AppleWare.dylib
  /Users/run/Payload/Roblox.app/Frameworks/AppleWare.dylib
  2⤵
  PID:504

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:511

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:513

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:513

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2025

Terms | Privacy