Overview

overview

1

Static

static

1

4e3464a13b...77.zip

macos-10.15-amd64

1

Payload/Tr...2x.png

macos-10.15-amd64

1

Payload/Tr...ad.png

macos-10.15-amd64

1

Payload/Tr...ts.car

macos-10.15-amd64

1

Payload/Tr....dylib

macos-10.15-amd64

1

Payload/Tr....plist

macos-10.15-amd64

1

Payload/Tr...kgInfo

macos-10.15-amd64

1

Payload/Tr...allerX

macos-10.15-amd64

1

Payload/Tr...ore.gz

macos-10.15-amd64

1

TrollStore.tar

macos-10.15-amd64

1

TrollStore...29.jpg

macos-10.15-amd64

1

TrollStore...2x.jpg

macos-10.15-amd64

1

TrollStore...3x.jpg

macos-10.15-amd64

1

TrollStore...40.jpg

macos-10.15-amd64

1

TrollStore...2x.jpg

macos-10.15-amd64

1

TrollStore...3x.jpg

macos-10.15-amd64

1

TrollStore...50.jpg

macos-10.15-amd64

1

TrollStore...2x.jpg

macos-10.15-amd64

1

TrollStore...57.jpg

macos-10.15-amd64

1

TrollStore...2x.jpg

macos-10.15-amd64

1

TrollStore...3x.png

macos-10.15-amd64

1

TrollStore...60.jpg

macos-10.15-amd64

1

TrollStore...2x.jpg

macos-10.15-amd64

1

TrollStore...3x.jpg

macos-10.15-amd64

1

TrollStore...72.jpg

macos-10.15-amd64

1

TrollStore...2x.jpg

macos-10.15-amd64

1

TrollStore...Helper

macos-10.15-amd64

1

TrollStore...lStore

macos-10.15-amd64

1

TrollStore...helper

macos-10.15-amd64

1

Payload/Tr...es.xml

macos-10.15-amd64

1

Payload/Tr....dylib

macos-10.15-amd64

1

Analysis

  • max time kernel
    43s
  • max time network
    38s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    18/08/2024, 10:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Payload/TrollInstallerX.app/Frameworks/libswift_Concurrency.dylib

  • Size

    7.3MB

  • MD5

    f903196309f5945ae642ad484c74829b

  • SHA1

    dedfe53921cf4dd2bf577e0ae7321422c63c7a62

  • SHA256

    d33fcbe4a664d8612a041bafe3e118672780f3884ae9b31d499089f12aec74fc

  • SHA512

    38b9fd8df24f210b0067af1a710a1f2e5d5b4acd9225d687ea6a37b256d30ee9a05127e0fbf0bd1e78c7537bf715f33b27afeace17bc52c599fa23762e69d6ed

  • SSDEEP

    98304:p7wWR31hyqkNVqEdAm0pXYOifagn700AgLCX2O4o9bUj:DjhyqIqEdAFYOifagno0AgLCGax

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/Payload/TrollInstallerX.app/Frameworks/libswift_Concurrency.dylib\""
    1⤵
      PID:493
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/Payload/TrollInstallerX.app/Frameworks/libswift_Concurrency.dylib\""
      1⤵
        PID:493
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/Payload/TrollInstallerX.app/Frameworks/libswift_Concurrency.dylib
        1⤵
          PID:493
          • /bin/zsh
            /bin/zsh -c /Users/run/Payload/TrollInstallerX.app/Frameworks/libswift_Concurrency.dylib
            2⤵
              PID:494
            • /Users/run/Payload/TrollInstallerX.app/Frameworks/libswift_Concurrency.dylib
              /Users/run/Payload/TrollInstallerX.app/Frameworks/libswift_Concurrency.dylib
              2⤵
                PID:494
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.sysmond
              1⤵
                PID:516
              • /usr/libexec/sysmond
                /usr/libexec/sysmond
                1⤵
                  PID:516
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.audio.AudioComponentRegistrar
                  1⤵
                    PID:517
                  • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                    /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                    1⤵
                      PID:517
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                      1⤵
                        PID:523
                      • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                        1⤵
                          PID:523
                        • /bin/launchctl
                          /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                          1⤵
                            PID:534
                          • /bin/launchctl
                            /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                            1⤵
                              PID:535

                            Network

                            MITRE ATT&CK Matrix

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads