Overview

overview

10

Static

static

1

81f8f05267...kes118

macos-10.15-amd64

1

TinkaOTP/T....dylib

macos-10.15-amd64

1

TinkaOTP/T....dylib

macos-10.15-amd64

1

TinkaOTP/T....dylib

macos-10.15-amd64

1

TinkaOTP/T....dylib

macos-10.15-amd64

1

TinkaOTP/T....dylib

macos-10.15-amd64

1

TinkaOTP/T....dylib

macos-10.15-amd64

1

TinkaOTP/T....dylib

macos-10.15-amd64

1

TinkaOTP/T....dylib

macos-10.15-amd64

1

TinkaOTP/T...nkaOTP

macos-10.15-amd64

10

TinkaOTP/T...nu.nib

macos-10.15-amd64

4

Analysis

  • max time kernel
    130s
  • max time network
    131s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    01-08-2024 22:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    TinkaOTP/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib

  • Size

    657KB

  • MD5

    f05437d510287448325bac98a1378de1

  • SHA1

    fa3deb60b8a2eaa29a7dccf14bee6adae81f442f

  • SHA256

    846d8647d27a0d729df40b13a644f3bffdc95f6d0e600f2195c85628d59f1dc6

  • SHA512

    466999585e7b09e729def6e13c719b656ba7ee9ca43ea32c8fb3a6177de81a75caf9bd5eb0c0ac172c2b7fea3c1aa57d10349ff98aac472fe2ffafde8cd30165

  • SSDEEP

    12288:z1EzSBGD7KAve8xCH0yjCxCZG0MCmBRrNyU/WvK4o7ZXnkSA/RnJ2zOA:zAxCZTMCOL/qKVXnkl/Wzv

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/TinkaOTP/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib\""
    1⤵
      PID:480
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/TinkaOTP/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib\""
      1⤵
        PID:480
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/TinkaOTP/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib
        1⤵
          PID:480
          • /bin/zsh
            /bin/zsh -c /Users/run/TinkaOTP/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib
            2⤵
              PID:481
            • /Users/run/TinkaOTP/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib
              /Users/run/TinkaOTP/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib
              2⤵
                PID:481
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.newsyslog
              1⤵
                PID:522
              • /usr/sbin/newsyslog
                /usr/sbin/newsyslog
                1⤵
                  PID:522

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads