evilquest | 59d69d11dbb3753afdf437c4bf26f065e2b3f5b6453bf03d08982c40efbd1790

Analysis

max time kernel
149s
max time network
123s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
23-08-2024 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-23_d6fc2c336522a8196b58eb9d563b41fa_adload_evilquest_rekoobe
Size

168KB
MD5

d6fc2c336522a8196b58eb9d563b41fa
SHA1

c927b87bf16ccbc941645cd866d4136a840febd4
SHA256

59d69d11dbb3753afdf437c4bf26f065e2b3f5b6453bf03d08982c40efbd1790
SHA512

c501e402bd3e270bc26bc420fc751c7ce433a23ebdbaca339fc08cf0d00d9778f9d28510defc42eb9735597a4d4939a304de0f1f18961f9d535a37f15b1b6ccb
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9D0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

resource	yara_rule
behavioral1/files/0x000000030008c2d3-0.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-3.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-8.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-13.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-18.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-23.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-28.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-33.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-38.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-43.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-48.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-53.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-58.dat	family_evilquest
behavioral1/files/0x000000030008c2d3-63.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

Launchctl 1 TTPs 16 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.var-db-dslocal-backup
1⤵
PID:481

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-08-23_d6fc2c336522a8196b58eb9d563b41fa_adload_evilquest_rekoobe\""
1⤵
PID:482

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-08-23_d6fc2c336522a8196b58eb9d563b41fa_adload_evilquest_rekoobe\""
1⤵
PID:482

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkreporter
1⤵
PID:483

/usr/bin/xar
/usr/bin/xar -c -f dslocal-backup.xar dslocal
1⤵
PID:481

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-08-23_d6fc2c336522a8196b58eb9d563b41fa_adload_evilquest_rekoobe
1⤵
PID:482
- /bin/zsh
  /bin/zsh -c /Users/run/2024-08-23_d6fc2c336522a8196b58eb9d563b41fa_adload_evilquest_rekoobe
  2⤵
  PID:489
- /Users/run/2024-08-23_d6fc2c336522a8196b58eb9d563b41fa_adload_evilquest_rekoobe
  /Users/run/2024-08-23_d6fc2c336522a8196b58eb9d563b41fa_adload_evilquest_rekoobe
  2⤵
  PID:489

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:483

/usr/libexec/xpcproxy
xpcproxy com.apple.gkreport
1⤵
PID:484

/usr/libexec/gkreport
/usr/libexec/gkreport
1⤵
PID:484

/usr/libexec/xpcproxy
xpcproxy com.apple.systemstats.daily
1⤵
PID:485

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
1⤵
PID:486

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:487

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:488

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:486

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:487

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:488

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:490

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:490

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:490

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:496

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:496

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:497

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:497

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:498

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:498

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:498

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:499

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:499

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:500

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:500

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:500

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:501

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:501

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:501

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:502

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:502

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:502

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:503

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:503

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:503

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:504

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:504

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:504

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:506

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:506

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:506

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:507

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:507

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:507

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:529

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:530

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:533

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:534

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:534

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:535

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:535

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:540

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:540

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:541

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:541

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:541

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:544

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:552

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:553

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:553

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:554

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:554

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:556

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:556

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:557

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:557

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:559

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:559

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:560

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:560

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:561

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:564

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:564

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:565

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:566

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:566

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:567

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:570

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:570

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:571

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:571

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:572

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:572

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:574

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:574

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:575

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:575

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:576

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:576

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:578

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:578

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:579

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:579

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:580

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:580

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:589

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:589

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:590

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
a5be49416a5ea6813b41e86b2724d9b2

SHA1
809cb0242252a0b4f07be760349449021732da99

SHA256
8f44389dd987264087d678a4195effa166811f24e829d4ee08824152ca3f3bec

SHA512
d773ddc1760f32cc28569ab30c7369a27d472043732facffe514b6f9bdf2ccfaa477f698b7a61279672f5f54b9a219631f10dd6ad7111b758ba26f2187ca3bd7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ee2fd44b5e283b557f50472f6a6b71be

SHA1
8f631eb4cb1f1947ae29a45f27c1973c8e69392e

SHA256
aed779eadf0f0a8a93c12b0c848db4646953b45e14f09c9ce2bedc2607915dad

SHA512
fba02dfdda5851eb348880656d5fa41a7afbc3d346e05669282ad901ef0b869d01f24a64cafbe5e5238e3a6f4307c132ae6e970eaace5e3158c302c7595331eb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9438fa83169f7c2a77356a5630867c37

SHA1
79dddfbb4bbf6731c4e7ec287bb82250249aa9d9

SHA256
02f4d6dff9fb3e7cbd98b8b2c2d7cbb7506670745087914a9e1ccef0d672af57

SHA512
2b0c544c19ce05d86eb541103b81451508734ba19c228685d8b71bbe0d37042b6172cf6a5b9ee2ab3ff391502cfd7ad621fe7e6e5fdd818d07afce77db28b003

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
071221816355a49bd4ca9cebdfba2dec

SHA1
60f69aa82e814df7b22c53d2d479a69b1ed1bbb5

SHA256
1159ae0a53b41a76b1b900fdbc20cb1a278e4d3f7e1156dcc8ecee077783e1e8

SHA512
53e9118ba91088bfa783da473c3045ece25a9b5aedc0ebf6a4552f4a16e9d608bebb151b6d926e77b6e918cdb27cd47f0a22f54854e52ed3ef5cf398424ff2ee

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
b60737c0b455148ff1b36c51267d6f5d

SHA1
bb523544f2bcab64e9c01280bf71d6e272e19706

SHA256
a182e2812d2a3a09f6cca5a5b1fba29056a7e89af3f8cccbd98dfd8b9be3fa37

SHA512
b9e1fcd7e639de29fab199d0c387c3235fea1580585754bfb0d0ff17b27795f9d46611c281e4726e121231fc8becbc0ebf80bb1a3598e0e24d150af09cb870f3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
ddd9130e0157e87e58f2a03df322c112

SHA1
1cfcf4f7504a1041a0731373174f486a8bf0d2f7

SHA256
f4b3a26996f0cd4aafe6d6511f2e60d5958bd8ecc03dd6013e4df98bead4e47e

SHA512
fd7cf4267ccac8551b485cb03162aa059cf64c3ac2e74c7eb99b03567f10797567f4b36fbb17ff670853a16c9c53597de189c647cec1a1ac8a4dcd31e5ccb1b5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
0d991d36d65e497af2df475708dfa3b7

SHA1
cc4a3bffd026802fb1e8c51be1bfde2bfacbb785

SHA256
f9c2f4d318e67ba6151fefd0b19730961ad8d8cd1329be0a9c150806fb08f4ee

SHA512
e714c633b173710b9dae0923be2d9f7505d92283f4da6fb1141ca1e54246cf06aa92ae5af138d1ef37d54d776af768ef6b2ea49f910be04b152be0d881532f8a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
afff38936131e8e7a86b82dbe090fc7d

SHA1
e308c333f6e6961802b499acccb34b250611a21a

SHA256
0a0509efc0cc98fa636ab32ff4c99cf82307cdfd20935eafad68ab9d8537ff20

SHA512
2deb35ea2ab7ffca000f6e20ea01e54ca3a2a3fa3f9af989e1f77291c3d0e0b344b4634dc19a489be2aa2a531593f85e5b4b86fb6c2e8680e135fd66d1e9c9d8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
f56ecc1a626a1e85134e90ffba10d16f

SHA1
d4347d0c4e60e3b3985548bade7ebeec05804181

SHA256
5884601185a0ca78c954817d7277957905f64129ac852f1d2a44aef978566316

SHA512
30549f63e53c1eff78fa65248023ce524e538d79db327795c6fbcc181b611bc83a3abf0e63bdc27978b39643f304cb2496f37696ddeb94b37537279ffeac9c57

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
90fd4457842f33365672ea2c64fea2ef

SHA1
3b153789c21ae7303586e577b8dfed46d58f0b45

SHA256
b30cdc41c789a2415b3b8b48d0a3e204c41bda11e1e7b1600181a9e6439e27c8

SHA512
82fcb56c6cd622b2dd0ef1af6c38a9894494e22de0dd054eac49bc71e126d6165f588ba4842fd0a38f06c49edbd5d45052f82260991689c1a4e26fa9f5645e8a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
4a1031f29ae318d33048add69d90be63

SHA1
5209c49a0c1190f0bfedf7563b1d05ea1e0a9ebb

SHA256
0868d4893df8a525c719cab69b1f398ffb5be54ff30f43ae14890b7f22e113bf

SHA512
0ac9c7c864adc72b3c9045542c4adb01cc8a50c5ba93e2672aa1e9e7d60e318a016f5be94b1bcaab46361106484510e12c9ce1270742746b5bae44cd9d306f31

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
9e5af9e3c0384d21a37319cd3127093a

SHA1
e98a1a3a60b634898c33c426551d4e29909f1462

SHA256
57f2319e409f0f3e5334bfba4113b11ff29d8ff50c5c241c9ccb729029fbc329

SHA512
89bbdaa41842e449ea64b0fcae0349d842c571a6927ddba12aec74877f5cd01490edd155a4149285b1517199ad4372f07ebcf36e0651ed72df1e6cbc7663ef91

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_79C87F0E-9227-5AAD-AA91-25F794E1F52E.plist

Filesize
156B

MD5
440695be144ad3d1bc04d3d4108b4612

SHA1
dc29f090bbd51b5e166f4d4faafd7b6526d574fd

SHA256
a688739b30c91dc943ab4c0c3a7d689153073ca8bc46979bd756a303101df648

SHA512
2dae32cf019fd423a3ea785c72da9abaa55b89e03d176d309107098c264dc6dbfa985da7008f14980b9294c123879c40122b311c025ee73fa521f1214d6e8b66

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2bf5c09f1e688632cf9c38876e1dd4d7

SHA1
0251d914b9d877ad4a8496865f3df14c3b7134be

SHA256
71976d45b5cf5632aaea712fcd75168497f042de3a7c997d2ea35b08b7623173

SHA512
99d20f95deeb138942aa8bd52d4d30d8aa60432fe6aa057f149cb7a66dab5b541f78112206b83e92ff6bdfda676aa7df24b05c764dc6359ab55d1373e9df52c9

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
470a5492dc81a6f2f5bca2182668c7b6

SHA1
d96f6d71227fbc66e2da7df63d07f23737c119ae

SHA256
2740898076a491c9ccaa88381dc4b18c862c466ef71412567a326ac2578a04be

SHA512
0abb050d6ebd0a398108ed810e50f7b7401f949b84c6deb7a8484ab669e588b220b5753d191378d3135e24ce1f87edc22d7ce08bac1ef2645a7f1b3f06ba54ce

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6f5fbefe4d3e9f968e80e35216d0ce59

SHA1
c4cdbdace9c5923756b74c20e820f2ed355c8d36

SHA256
a835dd3ac6dca93bc96daa631a1e4a0a361eedb880c1d6584469abcebad7842c

SHA512
d27142b538921a6d347d9c75c0c27eb5ea9d5fc7fbb53de7ea87895a49848db30e6493695e95cb44b57505e0944816d8528331fa743cb293b7514ab67b2c48c7

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
35ca2927872bd709eee94b3e5b69a6b0

SHA1
893369668f90d3e539d968cb11a78f03212a9af7

SHA256
a776266327bbf15f3fb2744cf516f1c7fa3d2919c60b1dc087b1202fbc7ea5b6

SHA512
0bf2dc6f7c3debefcd79a5d388bdb323adcedb45e4cc6dfb92afcb04913e3a393b2d4c39d27364948d4098ccc6c1fa485063eeabe76ae2edfc377ae4a8de9751

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0bb7aea006284d2ddc33ca3c43a1bba1

SHA1
a9b212e8180aea0290f1962ed200d5057192665b

SHA256
0a957a54860258d5b3339ed2458685d181a34adc2437ce0860cca81e49446581

SHA512
f6d575323e7ad9c70e0c73ce1ce5a30e4839bd65b1e331056a1dd52f43a92c5d6983ee01f3dbe8c658635e7f60dc77cebff04db57cf49c19422da02fd940a243

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
f150491941ccf94998ba03419709f875

SHA1
f83c0a608536a5740f8f5ab90dc8ec76be4d61c3

SHA256
9e154ca8c03a8dc89d6a6154635b1c7b36bc89275f66cb6f5ecceb73fd711be9

SHA512
9df2b46624607f8c95e2793793f7d8d3c907897f1d7758b65e635718777eaeb3612b7094027658a546ea8ad05862503bb2c21a29608fe459cf051472450986cb

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7e4b338e30ff6ae70ac7dadc657d3255

SHA1
c34c81bc0c532b90c513d414be59abdd0c378cff

SHA256
e946448ac031c84d6595e4dc89f375ce3ccf8a0f7e6f8b3b72b424f7e2c6335d

SHA512
5fa7146ab29f08dc5ba32d133862f7cdbed9858d2fce17fb5f8e681985bf6bdc6b4ca0971b3124e1701345f7ef180b1fa4d535bdbc3ccdc3c0e8a0a93c15655e

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c2a66b216043832a72744d6a68c1b098

SHA1
f4bd44fda2d5a38ccccbf2e562ab7e6a6042da40

SHA256
1a538cb7baab0b7cfb1ce9f49c404537a799389120765d80b4c00d7a47bd839e

SHA512
14a6b1a807c1737332d8b1c025d0a6fa74dcc89d9de3bc72a2e1a195247f3857a324d43b7b9c29ac4e7f14635acd093981e2db765d0aea467434046e142829ae

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
0b4841fd759ea98a156ab3e011260eb8

SHA1
87c8140906f3cf8401c4a355ad095d0ad32abc9a

SHA256
0fb47aca4c08a3231f8c0472c0814861cf20f725fd4c5e789f558b295474cfa1

SHA512
5c0b4d07e880f417946c02a7a8f80fdc70346eb44c1aed311bccc8d539ea39c1fb0b0f0869f2ec4207613a57055117c2eec751feabdd627556f72c9a53945ce8

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
80cc12598c8a759ecdf3c983d5591148

SHA1
e63303edc900f949da3d9a19b53856b8c3788ff6

SHA256
76186d1c80717c0e273c05e25ba82d90f3af181bb3c467167ae8d098d9d58723

SHA512
1113c2848abfa0d108de50e0892cf7073c00839707078a48be07f5fc1670c901f3e1df512eacebda2ed610d951536b4e966b2667c77c59a0bb40430e67a7c58f

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a19890e75e8a25f93ced5251a1e52c61

SHA1
ce069989e35fb47ac3c6c69f395d995c3d7ee8f9

SHA256
9a364cdd9832931dfb01232ce79661c0d8e5d37ba307b39e37b0fb9c2ae9a6f9

SHA512
c0865ec4dea626c35199b30915c217aa18ca77154f4bbfc8ff42402478379d4a428b02e0d63626d2d9514fd05b47df79a3ca1532859132349ca5eb91f6171cfd

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7e49b474d82e30a3c8c84d32641cabc5

SHA1
18db7468fbd28bf52d26450899dd97c39f29bb0f

SHA256
ac6ff28b6dd69236b55fa0ced396a1add18fa1219a4051e7db7b1c9ad784130d

SHA512
f373ded9ea1281ac28ecf03e606772d42067cea07874d08678e2d686ebaf854303c3bea7a965d9ae2196b3f1902cc19d2753253f709175c7d69394335c2bb5e0

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1804d8573c720c43dff14cdb60da17ca

SHA1
71ad469c9ba01398140d089fa0b8c2d569236e65

SHA256
84d61a6d5bc1f1c9cd46e276afd774e3903042ed0f7f4f5871887af734bb1d35

SHA512
52435797a4a5d7dd8d4f079f2d63fc5d2f82b88e4cc3507c8fb77b617af2d3d4f0dd0555c2826859567d62d4063b5149c34147908a64ad132e0e0f5a3ab00f42

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ee6b36156a4dacc83f7a900f196e9306

SHA1
aebc3e8448f9b35698134446f16996f6c1eb3a18

SHA256
c3a05a968990f918615508bd7ddb1040d10ee654f40c3bac94c5ed5461058d6c

SHA512
cffe4c1d712da45ff3ee57963c4c8fd8dbb50b255bb480f61cfe91e0e9d44f443c110c95ca61e5a73cda0f44e99522aa74dc2ac0a0fd724d0e4a5845c95e1390

Download Submit