Overview

overview

4

Static

static

3

XMouseButt....5.exe

macos-10.15-amd64

1

$PLUGINSDI...md.dll

macos-10.15-amd64

1

$PLUGINSDI...ns.dll

macos-10.15-amd64

1

$PLUGINSDI...er.dll

macos-10.15-amd64

1

$PLUGINSDI...em.dll

macos-10.15-amd64

1

$PLUGINSDI...al.ini

macos-10.15-amd64

1

$PLUGINSDI...rd.bmp

macos-10.15-amd64

1

$PLUGINSDI...gs.dll

macos-10.15-amd64

4

BugTrapU-x64.dll

macos-10.15-amd64

1

XMouseButt...ol.exe

macos-10.15-amd64

1

XMouseButtonHook.dll

macos-10.15-amd64

1

uninstaller.exe

macos-10.15-amd64

1

$PLUGINSDI...md.dll

macos-10.15-amd64

1

$PLUGINSDI...em.dll

macos-10.15-amd64

4

Analysis

  • max time kernel
    1007s
  • max time network
    1801s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    31-08-2024 16:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    XMouseButtonControlSetup.2.20.5.exe

  • Size

    2.9MB

  • MD5

    2e9725bc1d71ad1b8006dfc5a2510f88

  • SHA1

    6e1f7d12881696944bf5e030a7d131b969de0c6c

  • SHA256

    2240bf5fb5d80938b0676c46ef9f84bc1739c32f60c473ff85e530ae0eca2818

  • SHA512

    62bd9cde806f83f911f1068b452084ef2adc01bc0dec2d0f668a781cc0d94e39f6e35618264d8796ca205724725abd40429f463017e6ca5caf7d683429f82d39

  • SSDEEP

    49152:n65SJw48kZN+nCYk7c44+Y0hdwn4Km2A5aT/pVE0hYYajihV2Qso0SWMrboF:tfpeno4oY0QZm2dlNJsrHM4

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/XMouseButtonControlSetup.2.20.5.exe\""
    1⤵
      PID:477
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/XMouseButtonControlSetup.2.20.5.exe\""
      1⤵
        PID:477
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/XMouseButtonControlSetup.2.20.5.exe
        1⤵
          PID:477
          • /bin/zsh
            /bin/zsh -c /Users/run/XMouseButtonControlSetup.2.20.5.exe
            2⤵
              PID:478
            • /Users/run/XMouseButtonControlSetup.2.20.5.exe
              /Users/run/XMouseButtonControlSetup.2.20.5.exe
              2⤵
                PID:478
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.PerformanceAnalysis.animationperfd
              1⤵
                PID:527
              • /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                1⤵
                  PID:527
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.Safari.2028
                  1⤵
                    PID:528
                  • /Applications/Safari.app/Contents/MacOS/Safari
                    /Applications/Safari.app/Contents/MacOS/Safari
                    1⤵
                      PID:528
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.Safari.History
                      1⤵
                        PID:529
                      • /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
                        /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
                        1⤵
                          PID:529
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.WebKit.WebContent.DB0A36C7-D8EC-494E-A786-8E33F5495AFE 528
                          1⤵
                            PID:530
                          • /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                            /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                            1⤵
                              PID:530
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.SafariLaunchAgent
                              1⤵
                                PID:535
                              • /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
                                /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
                                1⤵
                                  PID:535
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.WebKit.WebContent.70A4F9F3-19FD-4B7A-BD29-7DB77E36AF82 528
                                  1⤵
                                    PID:536
                                  • /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                    /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                    1⤵
                                      PID:536
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.Safari.SearchHelper 528
                                      1⤵
                                        PID:537
                                      • /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
                                        /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
                                        1⤵
                                          PID:537
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.Safari.SafeBrowsing.Service
                                          1⤵
                                            PID:538
                                          • /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
                                            /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
                                            1⤵
                                              PID:538
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.accessibility.mediaaccessibilityd
                                              1⤵
                                                PID:539
                                              • /System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
                                                /System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
                                                1⤵
                                                  PID:539
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.WebKit.WebContent.117B4393-8CEE-4084-8576-705DDA859345 528
                                                  1⤵
                                                    PID:541
                                                  • /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                    /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
                                                    1⤵
                                                      PID:541
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.Terminal.2100
                                                      1⤵
                                                        PID:544
                                                      • /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                                                        /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                                                        1⤵
                                                          PID:544
                                                          • /usr/bin/login
                                                            login -pf run
                                                            2⤵
                                                              PID:546
                                                              • /bin/zsh
                                                                -zsh
                                                                3⤵
                                                                  PID:547
                                                                  • /usr/libexec/path_helper
                                                                    /usr/libexec/path_helper -s
                                                                    4⤵
                                                                      PID:548
                                                                    • /usr/bin/locale
                                                                      locale LC_CTYPE
                                                                      4⤵
                                                                        PID:549
                                                                • /usr/libexec/xpcproxy
                                                                  xpcproxy com.apple.audio.AudioComponentRegistrar
                                                                  1⤵
                                                                    PID:551
                                                                  • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                                                                    /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                                                                    1⤵
                                                                      PID:551
                                                                    • /usr/libexec/xpcproxy
                                                                      xpcproxy com.apple.audio.SandboxHelper 536
                                                                      1⤵
                                                                        PID:552
                                                                      • /System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
                                                                        /System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
                                                                        1⤵
                                                                          PID:552
                                                                        • /usr/libexec/xpcproxy
                                                                          xpcproxy com.apple.spindump
                                                                          1⤵
                                                                            PID:558
                                                                          • /usr/sbin/spindump
                                                                            /usr/sbin/spindump
                                                                            1⤵
                                                                              PID:558
                                                                            • /usr/libexec/xpcproxy
                                                                              xpcproxy com.apple.diagnosticd
                                                                              1⤵
                                                                                PID:559
                                                                              • /usr/libexec/diagnosticd
                                                                                /usr/libexec/diagnosticd
                                                                                1⤵
                                                                                  PID:559

                                                                                Network

                                                                                MITRE ATT&CK Matrix

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • /Users/run/Library/Safari/Favicon Cache/favicons/8F014D5A7CD7C2044ACCF3335418B504
                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  47e41dfbe59fe729f4ef634a2eea6c79

                                                                                  SHA1

                                                                                  b12aaed5549a52055b0436b401bdade3489a0ae6

                                                                                  SHA256

                                                                                  f523bbdcdd12844638d1c6c744345098c85b68796d5027799889232d25277b7e

                                                                                  SHA512

                                                                                  ad9bbae5e4e7538ccb584797c704163256a3622eb8d4e0b5b7b531eaca8a63ae2865a90d319e11a3745be9c018490a0db1fda38c9d978c2d3e30fa9a9eed4126

                                                                                  Download Submit

                                                                                • /Users/run/Library/Safari/Favicon Cache/favicons/FAC6209823ABE855825395CD2375BC87
                                                                                  Filesize

                                                                                  5KB

                                                                                  MD5

                                                                                  e1e737bef4982d7df356c76d584b225e

                                                                                  SHA1

                                                                                  b2ecd9b72188df2f15811fcd008144cbff537f84

                                                                                  SHA256

                                                                                  0d77260d95a147a97dcb947e233b9a2167245c7b0a8a6a6a5e58dc5f196fd2d6

                                                                                  SHA512

                                                                                  ccaf727f9346cf594d0e60081bf5b039808a31e5511defaaccbfcdd40e22697df56cf452b3e7ec87e14f3d04e30ab72e4c2b3d6276f1d03716262d97253cef7c

                                                                                  Download Submit

                                                                                • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
                                                                                  Filesize

                                                                                  215KB

                                                                                  MD5

                                                                                  3bf14d51a0e8cb51a7f11bc40d5a28ff

                                                                                  SHA1

                                                                                  5fdce16cb591ee329f0219c182b52d3568cb44bb

                                                                                  SHA256

                                                                                  6def61e840a6968bc23218a8e1bb4d9fa25d1b756c40ef1cd748a3a8c4192507

                                                                                  SHA512

                                                                                  a3203252ed7b979f449bcc39cd27e01ac0651b56a10ee55a1cb7989ba4efe7bf3894a56db2bc5e5fa6d408dec44dcf98aace68332f0b78f1153a70cb915a8d21

                                                                                  Download Submit

                                                                                • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
                                                                                  Filesize

                                                                                  16.6MB

                                                                                  MD5

                                                                                  96e02e11cdfecb6af6fa60a36acc26aa

                                                                                  SHA1

                                                                                  845e7e8b540c295ff8ef0d4ed139086ecd18d5a0

                                                                                  SHA256

                                                                                  f53c33bc8e6855a677a24a745461259301432bc01877830e6772d8136729d6df

                                                                                  SHA512

                                                                                  9aade41dca474198875faa7bcf46e6ca7386dcfbbf0fb7831e97b0fd6c6a3093e93136bd4f147b87d15de9e535619e571d55634339d4759a4c45d2d679b6d309

                                                                                  Download Submit

                                                                                • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
                                                                                  Filesize

                                                                                  129KB

                                                                                  MD5

                                                                                  73b8deaa705d438e91267d98b0a96a5f

                                                                                  SHA1

                                                                                  aeb34dc00e07a317adb4142c1facc0865e02dc7a

                                                                                  SHA256

                                                                                  4ded39affb05b1cd87a4b7e0e40139f8a57ccb542a45d38d0cb404216ddcf3e5

                                                                                  SHA512

                                                                                  38d1eddac66fc7da9c7a9e47523ce63333d36ef4171494e3d8bbc1bee20781200fcefc950d2eec0bbc4d3b6fa4e30b4ff14a8c8d63ac0cd41ad07f19274ca2a7

                                                                                  Download Submit

                                                                                • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db
                                                                                  Filesize

                                                                                  47KB

                                                                                  MD5

                                                                                  0e4a0d1ceb2af6f0f8d0167ce77be2d3

                                                                                  SHA1

                                                                                  414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

                                                                                  SHA256

                                                                                  cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

                                                                                  SHA512

                                                                                  1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

                                                                                  Download Submit

                                                                                • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db
                                                                                  Filesize

                                                                                  4KB

                                                                                  MD5

                                                                                  d3a1859e6ec593505cc882e6def48fc8

                                                                                  SHA1

                                                                                  f8e6728e3e9de477a75706faa95cead9ce13cb32

                                                                                  SHA256

                                                                                  3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

                                                                                  SHA512

                                                                                  ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

                                                                                  Download Submit