Overview

overview

4

Static

static

1

iconik Age...64.dmg

macos-10.15-amd64

4

iconik Age... (GPU)

macos-10.15-amd64

1

iconik Age...kAgent

macos-10.15-amd64

1

iconik Age...Helper

macos-10.15-amd64

4

iconik Age...dex.js

macos-10.15-amd64

4

iconik Age...t-util

macos-10.15-amd64

4

iconik Age...dex.js

macos-10.15-amd64

4

iconik Age...oad.js

macos-10.15-amd64

4

iconik Age...ile.js

macos-10.15-amd64

4

iconik Age...ker.js

macos-10.15-amd64

4

iconik Age...er1.js

macos-10.15-amd64

4

iconik Age...x.html

macos-10.15-amd64

4

iconik Age...dex.js

macos-10.15-amd64

4

iconik Age...oad.js

macos-10.15-amd64

4

iconik Age...x.html

macos-10.15-amd64

4

iconik Age...dex.js

macos-10.15-amd64

4

iconik Age...oad.js

macos-10.15-amd64

4

Analysis

  • max time kernel
    251s
  • max time network
    302s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    15/07/2024, 10:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    iconik Agent/iconik Agent.app/Contents/Resources/app/.webpack/main/certificate/cert-util

  • Size

    3.4MB

  • MD5

    d988b5f2dfe36b63cf246e03feef10e2

  • SHA1

    7ce95e700f0cdeef01e98b7cef21094a38321fba

  • SHA256

    9abe364e02f46bcfb2a1b4749c3dfc6fb2e86dda46b47292ffe3ca61f8fcba30

  • SHA512

    e107806c1cc7d4bbca1b17975c01398a66126756480cb61df3df00d0551bc00cd78841a213b7aa703d489d7deb45179b6c4c2fd583daa16c227f381f67648aa3

  • SSDEEP

    49152:sHWmpIkwBM7xHg7w6RxHg7bey+9nNL9djWI3RxHg7/9RxHg7:ySFn7dj

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/iconik Agent/iconik Agent.app/Contents/Resources/app/.webpack/main/certificate/cert-util\""
    1⤵
      PID:481
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/iconik Agent/iconik Agent.app/Contents/Resources/app/.webpack/main/certificate/cert-util\""
      1⤵
        PID:481
      • /usr/bin/sudo
        sudo /bin/zsh -c "/Users/run/iconik Agent/iconik Agent.app/Contents/Resources/app/.webpack/main/certificate/cert-util"
        1⤵
          PID:481
          • /bin/zsh
            /bin/zsh -c "/Users/run/iconik Agent/iconik Agent.app/Contents/Resources/app/.webpack/main/certificate/cert-util"
            2⤵
              PID:482
            • /Users/run/iconik
              /Users/run/iconik Agent/iconik Agent.app/Contents/Resources/app/.webpack/main/certificate/cert-util
              2⤵
                PID:482
            • /bin/launchctl
              /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
              1⤵
                PID:506
              • /bin/launchctl
                /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                1⤵
                  PID:507
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                  1⤵
                    PID:516
                  • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                    /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                    1⤵
                      PID:516

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads