Analysis

  • max time kernel
    98s
  • max time network
    109s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    18/08/2024, 10:55

General

  • Target

    TrollStore.app/[email protected]

  • Size

    10KB

  • MD5

    da9f2efdcc1ece69e86f11e37715a55e

  • SHA1

    0c833c0c11422677ae7d9dda23502afda6303bf0

  • SHA256

    1da4adfab4b7b74b9b4e5dc89e534a67c474830e14f4500737ddabc9b3bdbcf7

  • SHA512

    fe8e2a756003abd10ebd60cfa872b069afcd1f1eb80e26f4f5e96bddf9f6fac6ca1f5b31c36d5423cbec16064bd0cf136bf78cf1e3f59edd8317b3df749b73a2

  • SSDEEP

    192:BL6BPzNQjeAacAKC3vcj4yMd4nMIIgSJLwTmIpeT1ORpGRDmCoDGiIowA:B8PzBveovckyC0drSuTmAsypGNWS6

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/TrollStore.app/[email protected]\""
    1⤵
      PID:487
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/TrollStore.app/[email protected]\""
      1⤵
        PID:487
      • /usr/libexec/xpcproxy
        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
        1⤵
          PID:528
        • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
          /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
          1⤵
            PID:528
          • /bin/launchctl
            /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
            1⤵
              PID:532
            • /bin/launchctl
              /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
              1⤵
                PID:533

              Network

              MITRE ATT&CK Matrix

              Replay Monitor

              Loading Replay Monitor...

              Downloads