Overview
overview
3Static
static
3XMouseButt....5.exe
macos-10.15-amd64
1$PLUGINSDI...md.dll
macos-10.15-amd64
1$PLUGINSDI...ns.dll
macos-10.15-amd64
1$PLUGINSDI...er.dll
macos-10.15-amd64
1$PLUGINSDI...em.dll
macos-10.15-amd64
1$PLUGINSDI...gs.dll
macos-10.15-amd64
1BugTrapU-x64.dll
macos-10.15-amd64
1XMouseButt...ol.exe
macos-10.15-amd64
1XMouseButtonHook.dll
macos-10.15-amd64
1uninstaller.exe
macos-10.15-amd64
1$PLUGINSDI...md.dll
macos-10.15-amd64
1$PLUGINSDI...em.dll
macos-10.15-amd64
1Analysis
-
max time kernel
82s -
max time network
127s -
platform
macos-10.15_amd64 -
resource
macos-20240711.1-en -
resource tags
arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
26-08-2024 18:58
Static task
static1
Behavioral task
behavioral1
Sample
XMouseButtonControlSetup.2.20.5.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral7
Sample
BugTrapU-x64.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral8
Sample
XMouseButtonControl.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral9
Sample
XMouseButtonHook.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral10
Sample
uninstaller.exe
Resource
macos-20240711.1-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
macos-20240711.1-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
macos-20240711.1-en
General
-
Target
XMouseButtonControl.exe
-
Size
1.7MB
-
MD5
bb632bc4c4414303c783a0153f6609f7
-
SHA1
eb16bf0d8ce0af4d72dff415741fd0d7aac3020e
-
SHA256
7cc348f8d2ee10264e136425059205cf2c17493b4f3f6a43af024aecb926d8c8
-
SHA512
15b34efe93d53e54c1527705292fbf145d6757f10dd87bc787dc40bf02f0d641468b95c571f7037417f2f626de2afcd68b5d82214e27e9e622ab0475633e9de5
-
SSDEEP
24576:WB9zyuRx7jLNquqvzbsM/m0GNYbOVgmXUWU7mFNeSOML3QaYyipFovO:WBJpf7j+LOVgmXUWU7UDTQaviXo
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/XMouseButtonControl.exe\""1⤵PID:490
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/XMouseButtonControl.exe\""1⤵PID:490
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/XMouseButtonControl.exe1⤵PID:490
-
/bin/zsh/bin/zsh -c /Users/run/XMouseButtonControl.exe2⤵PID:491
-
-
/Users/run/XMouseButtonControl.exe/Users/run/XMouseButtonControl.exe2⤵PID:491
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:529
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:529
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:534
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:535