Overview

overview

6

Static

static

3

Blitz-2.1.202.exe

windows7-x64

5

Blitz-2.1.202.exe

windows10-2004-x64

6

$PLUGINSDI...er.dll

windows7-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

$PLUGINSDIR/app-64.7z

windows7-x64

3

$PLUGINSDIR/app-64.7z

windows10-2004-x64

3

Blitz.exe

windows7-x64

1

Blitz.exe

windows10-2004-x64

6

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/...i.node

macos-10.15-amd64

4

resources/...i.node

macos-10.15-amd64

4

resources/...i.node

macos-10.15-amd64

4

resources/...i.node

macos-10.15-amd64

4

resources/...i.node

macos-10.15-amd64

4

resources/...al.dll

windows7-x64

1

resources/...al.dll

windows10-2004-x64

1

resources/...al.exe

windows7-x64

1

resources/...al.exe

windows10-2004-x64

1

resources/...ld.dll

windows7-x64

1

resources/...ld.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    146s
  • max time network
    131s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    24/08/2024, 16:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    resources/app.asar.unpacked/node_modules/classic-level/prebuilds/darwin-x64+arm64/node.napi.node

  • Size

    631KB

  • MD5

    b1a2256fc3a83e4c38701dd8601799bf

  • SHA1

    992a59c72740c0069693365a25e9b90705cb54f3

  • SHA256

    18b01d23ed59caf184d3236597d786190fd00dfd1b60b47827b6016aed4a0a6f

  • SHA512

    7a1d9b8d73632c2f78718fc9ef3ec0e95f40ba5daa9a8542d2a8d4291c155431ae4d8c91b74453f2eb8e40ef0d57be91e25a0c9bad10b295cbffb068eb52a913

  • SSDEEP

    12288:DP7t/ckazbcaodBk6gw9SY4jLpnOcctcr+gg:DP7t0kaU9k6dyr+P

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/resources/app.asar.unpacked/node_modules/classic-level/prebuilds/darwin-x64+arm64/node.napi.node\""
    1⤵
      PID:511
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/resources/app.asar.unpacked/node_modules/classic-level/prebuilds/darwin-x64+arm64/node.napi.node\""
      1⤵
        PID:511
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/resources/app.asar.unpacked/node_modules/classic-level/prebuilds/darwin-x64+arm64/node.napi.node
        1⤵
          PID:511
          • /bin/zsh
            /bin/zsh -c /Users/run/resources/app.asar.unpacked/node_modules/classic-level/prebuilds/darwin-x64+arm64/node.napi.node
            2⤵
              PID:512
            • /Users/run/resources/app.asar.unpacked/node_modules/classic-level/prebuilds/darwin-x64+arm64/node.napi.node
              /Users/run/resources/app.asar.unpacked/node_modules/classic-level/prebuilds/darwin-x64+arm64/node.napi.node
              2⤵
                PID:512
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
              1⤵
                PID:530
              • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                1⤵
                  PID:530
                • /bin/launchctl
                  /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                  1⤵
                    PID:533
                  • /bin/launchctl
                    /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                    1⤵
                      PID:534

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads