Overview
overview
3Static
static
3Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...UI.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...le.dll
macos-10.15-amd64
1Start Surv...ne.dll
macos-10.15-amd64
1Start Surv...ib.dll
macos-10.15-amd64
1UnityCrash...32.exe
macos-10.15-amd64
1UnityCrash...64.exe
macos-10.15-amd64
1UnityPlayer.dll
macos-10.15-amd64
1Resubmissions
11/08/2024, 03:09
240811-dnmdjswflb 3Analysis
-
max time kernel
116s -
max time network
157s -
platform
macos-10.15_amd64 -
resource
macos-20240711.1-en -
resource tags
arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
11/08/2024, 03:09
Static task
static1
Behavioral task
behavioral1
Sample
Start Survey_Data/Managed/UnityEngine.PhysicsModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral2
Sample
Start Survey_Data/Managed/UnityEngine.ProfilerModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral3
Sample
Start Survey_Data/Managed/UnityEngine.ScreenCaptureModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral4
Sample
Start Survey_Data/Managed/UnityEngine.SharedInternalsModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral5
Sample
Start Survey_Data/Managed/UnityEngine.SpriteMaskModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral6
Sample
Start Survey_Data/Managed/UnityEngine.SpriteShapeModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
Start Survey_Data/Managed/UnityEngine.StreamingModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral8
Sample
Start Survey_Data/Managed/UnityEngine.SubstanceModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral9
Sample
Start Survey_Data/Managed/UnityEngine.TLSModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral10
Sample
Start Survey_Data/Managed/UnityEngine.TerrainModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral11
Sample
Start Survey_Data/Managed/UnityEngine.TerrainPhysicsModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral12
Sample
Start Survey_Data/Managed/UnityEngine.TextCoreModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral13
Sample
Start Survey_Data/Managed/UnityEngine.TextRenderingModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral14
Sample
Start Survey_Data/Managed/UnityEngine.TilemapModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral15
Sample
Start Survey_Data/Managed/UnityEngine.UI.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral16
Sample
Start Survey_Data/Managed/UnityEngine.UnityTestProtocolModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral17
Sample
Start Survey_Data/Managed/UnityEngine.UnityWebRequestAssetBundleModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral18
Sample
Start Survey_Data/Managed/UnityEngine.UnityWebRequestAudioModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral19
Sample
Start Survey_Data/Managed/UnityEngine.UnityWebRequestModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral20
Sample
Start Survey_Data/Managed/UnityEngine.UnityWebRequestTextureModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral21
Sample
Start Survey_Data/Managed/UnityEngine.UnityWebRequestWWWModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral22
Sample
Start Survey_Data/Managed/UnityEngine.VFXModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral23
Sample
Start Survey_Data/Managed/UnityEngine.VRModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral24
Sample
Start Survey_Data/Managed/UnityEngine.VehiclesModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral25
Sample
Start Survey_Data/Managed/UnityEngine.VideoModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral26
Sample
Start Survey_Data/Managed/UnityEngine.WindModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral27
Sample
Start Survey_Data/Managed/UnityEngine.XRModule.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral28
Sample
Start Survey_Data/Managed/UnityEngine.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral29
Sample
Start Survey_Data/Managed/mscorlib.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral30
Sample
UnityCrashHandler32.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral31
Sample
UnityCrashHandler64.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral32
Sample
UnityPlayer.dll
Resource
macos-20240711.1-en
General
-
Target
Start Survey_Data/Managed/UnityEngine.PhysicsModule.dll
-
Size
86KB
-
MD5
1cc7c9e4068cc51ca0e05c6990a832c7
-
SHA1
3412fa03c040fe0f747af8f2374d8628e15d9ac1
-
SHA256
4bbe3c6f5bccb252d7e1ef1eb4480abb1eab985faa862cb028525bc6a96c5d34
-
SHA512
aa06fb1290176ef5dbe6a8a4466a9d582bd9af39bed8abb071ace6c9b1696a13bc68614b7d6f7b7e22af2026ed0f75ebc09780bab1cee02818550f5a0e5cd056
-
SSDEEP
768:w4DvU4mCsMJTv95y5b5r5XKgbiEayLIxmaCjDbs/dE2h1jVewQOlyWh3c:wG2Kc+1ayRIOlyWh3
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Start Survey_Data/Managed/UnityEngine.PhysicsModule.dll\""1⤵PID:488
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Start Survey_Data/Managed/UnityEngine.PhysicsModule.dll\""1⤵PID:488
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Start Survey_Data/Managed/UnityEngine.PhysicsModule.dll"1⤵PID:488
-
/bin/zsh/bin/zsh -c "/Users/run/Start Survey_Data/Managed/UnityEngine.PhysicsModule.dll"2⤵PID:489
-
-
/Users/run/Start/Users/run/Start Survey_Data/Managed/UnityEngine.PhysicsModule.dll2⤵PID:489
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.iChat.18801⤵PID:515
-
/System/Applications/Messages.app/Contents/MacOS/Messages/System/Applications/Messages.app/Contents/MacOS/Messages1⤵PID:515
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.toolbox.reporting.service1⤵PID:517
-
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService1⤵PID:517
-
/usr/libexec/xpcproxyxpcproxy com.apple.FaceTime.18601⤵PID:518
-
/System/Applications/FaceTime.app/Contents/MacOS/FaceTime/System/Applications/FaceTime.app/Contents/MacOS/FaceTime1⤵PID:518
-
/usr/libexec/xpcproxyxpcproxy com.apple.CharacterPicker.FileService1⤵PID:520
-
/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService1⤵PID:520
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 5151⤵PID:521
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵PID:521
-
/usr/libexec/xpcproxyxpcproxy com.apple.videoconference.camera1⤵PID:522
-
/usr/libexec/avconferenced/usr/libexec/avconferenced1⤵PID:522
-
/usr/libexec/xpcproxyxpcproxy com.apple.FaceTime.FaceTimeNotificationCenterService 5181⤵PID:523
-
/System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService/System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService1⤵PID:523
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 5181⤵PID:524
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵PID:524
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 5221⤵PID:525
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵PID:525
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:535
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:536
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:537
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:537
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD50e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA5121dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
-
Filesize
4KB
MD5d3a1859e6ec593505cc882e6def48fc8
SHA1f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA2563ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818