Overview
overview
7Static
static
7gibMacOS-master.zip
windows10-1703-x64
1gibMacOS-m...ibutes
windows10-1703-x64
3gibMacOS-m...ignore
windows10-1703-x64
3gibMacOS-m...ommand
windows10-1703-x64
3gibMacOS-m...App.py
windows10-1703-x64
3gibMacOS-m...ICENSE
windows10-1703-x64
1gibMacOS-m...ll.bat
windows10-1703-x64
1gibMacOS-m...all.py
windows10-1703-x64
3gibMacOS-m...dme.md
windows10-1703-x64
3gibMacOS-m...64.exe
windows10-1703-x64
7gibMacOS-m...t__.py
windows10-1703-x64
3gibMacOS-m...isk.py
windows10-1703-x64
3gibMacOS-m...win.py
windows10-1703-x64
3gibMacOS-m...der.py
windows10-1703-x64
3gibMacOS-m...ist.py
windows10-1703-x64
3gibMacOS-m...run.py
windows10-1703-x64
3gibMacOS-m...ils.py
windows10-1703-x64
3gibMacOS-m...OS.bat
windows10-1703-x64
1gibMacOS-m...ommand
windows10-1703-x64
3gibMacOS-m...cOS.py
windows10-1703-x64
3Behavioral task
behavioral1
Sample
gibMacOS-master.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
gibMacOS-master/.gitattributes
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
gibMacOS-master/.gitignore
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
gibMacOS-master/BuildmacOSInstallApp.command
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
gibMacOS-master/BuildmacOSInstallApp.py
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
gibMacOS-master/LICENSE
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
gibMacOS-master/MakeInstall.bat
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
gibMacOS-master/MakeInstall.py
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
gibMacOS-master/Readme.md
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
gibMacOS-master/Scripts/BOOTICEx64.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
gibMacOS-master/Scripts/__init__.py
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
gibMacOS-master/Scripts/disk.py
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
gibMacOS-master/Scripts/diskwin.py
Resource
win10-20240611-en
Behavioral task
behavioral14
Sample
gibMacOS-master/Scripts/downloader.py
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
gibMacOS-master/Scripts/plist.py
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
gibMacOS-master/Scripts/run.py
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
gibMacOS-master/Scripts/utils.py
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
gibMacOS-master/gibMacOS.bat
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
gibMacOS-master/gibMacOS.command
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
gibMacOS-master/gibMacOS.py
Resource
win10-20240611-en
General
-
Target
gibMacOS-master.zip
-
Size
520KB
-
MD5
b8572e8f4a90386e0b32770b9b604f72
-
SHA1
37fb4ee211266a533b5f22e607123317634ed434
-
SHA256
300727e0db9bbff01880643dad104c0f6c780222ee0f6fa914de0617ecf92fa3
-
SHA512
3c2521cccd4a996aac70926209a9599015f9fca8f85f60d460cf7bf711cf50c5814e97dbfb32d6757f13ea65eb0f9f11d810ce69c9c0fe715668fdb90e97b690
-
SSDEEP
6144:9RNX3a5r3lNUkcs01vO1AdZ/fL+8Pwtgj1CvGSxsbu3fvQtKpm1b1cYYzrqAb8qh:gYVZiN/vGSE6nIEm1yPzrF8WTe0C2n
Malware Config
Signatures
-
resource yara_rule static1/unpack001/gibMacOS-master/Scripts/BOOTICEx64.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/gibMacOS-master/Scripts/BOOTICEx64.exe
Files
-
gibMacOS-master.zip.zip
-
gibMacOS-master/.gitattributes
-
gibMacOS-master/.gitignore
-
gibMacOS-master/BuildmacOSInstallApp.command.sh linux
-
gibMacOS-master/BuildmacOSInstallApp.py.py .sh linux
-
gibMacOS-master/LICENSE
-
gibMacOS-master/MakeInstall.bat.bat .vbs
-
gibMacOS-master/MakeInstall.py
-
gibMacOS-master/Readme.md
-
gibMacOS-master/Scripts/BOOTICEx64.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 1.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 451KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
gibMacOS-master/Scripts/__init__.py
-
gibMacOS-master/Scripts/disk.py
-
gibMacOS-master/Scripts/diskwin.py
-
gibMacOS-master/Scripts/downloader.py
-
gibMacOS-master/Scripts/plist.py
-
gibMacOS-master/Scripts/run.py
-
gibMacOS-master/Scripts/utils.py
-
gibMacOS-master/gibMacOS.bat.bat .vbs
-
gibMacOS-master/gibMacOS.command.sh linux
-
gibMacOS-master/gibMacOS.py.py .sh linux