98bb30ec1732b1e19f1a3ed0de9d6ade2813fdf7c3795b93037fde3df5befe72

Analysis

max time kernel
143s
max time network
214s
platform
macos-10.15_amd64
resource
macos-20240711.1-en
resource tags

arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
11/09/2024, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98bb30ec1732b1e19f1a3ed0de9d6ade2813fdf7c3795b93037fde3df5befe72.dmg
Size

17.2MB
MD5

39cf0a66e523568307e1e8cc256aaea3
SHA1

5bb92429aabeaf83f532b83c56705d3f1654c270
SHA256

98bb30ec1732b1e19f1a3ed0de9d6ade2813fdf7c3795b93037fde3df5befe72
SHA512

c90bf3c50daf521a0e3c1fce0f597b5400bcf272a4416ee1bd8c376e0abd2f1b8a98bd04054b8b6ea349fcd074752d8cb87f083541b9a35646b67b0f8189e858
SSDEEP

196608:O71HiBoXE8nZBwJWzdDtTgV+cerdRBwRTCaXAh+Hs6hqeV0NInIlempIeKdTr8qN:O71Fh9B7RwZpXAQMYJIlLp4IQ8B7mSL

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Omni\\ Downloader/Omni\\ Downloader.app\""
1⤵
PID:524

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Omni\\ Downloader/Omni\\ Downloader.app\""
1⤵
PID:524

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Omni\\ Downloader/Omni\\ Downloader.app"
1⤵
PID:524
- /bin/zsh
  /bin/zsh -c "open /Volumes/Omni\\ Downloader/Omni\\ Downloader.app"
  2⤵
  PID:525
- /usr/bin/open
  open "/Volumes/Omni Downloader/Omni Downloader.app"
  2⤵
  PID:525

/usr/libexec/xpcproxy
xpcproxy com.minicreo.Omni-Downloader.2328
1⤵
PID:529

/Volumes/Omni Downloader/Omni Downloader.app/Contents/MacOS/Omni Downloader
"/Volumes/Omni Downloader/Omni Downloader.app/Contents/MacOS/Omni Downloader"
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.49F87D60-0413-4794-9778-4B44346F0806
1⤵
PID:533

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:544

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:543

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:537

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:544

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:546

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:547

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:548

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:548

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 534
1⤵
PID:553

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.minicreo.Omni-Downloader.3152
1⤵
PID:559

/Volumes/Omni Downloader/Omni Downloader.app/Contents/MacOS/Omni Downloader
"/Volumes/Omni Downloader/Omni Downloader.app/Contents/MacOS/Omni Downloader"
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:566

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.minicreo.Omni-Downloader.3152
1⤵
PID:569

/Volumes/Omni Downloader/Omni Downloader.app/Contents/MacOS/Omni Downloader
"/Volumes/Omni Downloader/Omni Downloader.app/Contents/MacOS/Omni Downloader"
1⤵
PID:569

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Application Support/Omni Downloader/LogsFolder/log-A1289C.txt

Filesize
4KB

MD5
3c731846f19c6e4de41287d2dd5feae5

SHA1
dd92062d2d3bfa53ad4ebe754e2e0c5180b34357

SHA256
7b0bd5e9394e322de689f9bddfd67e115185545cc7958cb19a8d5b240ce6298e

SHA512
4195d4886a27e5f5b3014ce85c9d0e33bf2d7b1bfcc4f3372bce337607634e140cc1459cebe4e18af0f9fe991a9b03338d6fe07012a4bce0e699f198b2f723e0

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/devscore.dat

Filesize
236B

MD5
8cbe76f3fc1457517598d73ac7bc3e9d

SHA1
f064bd7209edfd46f2883e5359b0bf124046d607

SHA256
9edaecd1e1d9b9226f83c23fb4b014c3fb69c00ffd0d1392759133de8a0ac612

SHA512
bed3ad48fa69a56343ebf540078c8e1e5844175893666437fb708355b0c2f54af2e43948d9dbdc5ff51ed2f36d6fe051dc1c243207594895716135cd781c2d62

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/exportconfig.dat

Filesize
608B

MD5
b41e7c74f9b7fca3fa490b20fb995cdf

SHA1
4b57727c713103dea4784d57ca93cdd44aac5505

SHA256
b7f56881a7e53a831660be74da411a87debf07da4e96290338109a90de14973b

SHA512
5e62162d5314b144d66558f09fc33a3ae9a32bfccdc66bbdd28a202d2b545294b693b88799e975a6b5c26ef180f3ca720fa50692a57c238a16643afba7d669bc

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/fdinfos.dat

Filesize
238B

MD5
b866cc87d34ddfa1ba908d00897e3370

SHA1
f6ad4a1869b00d1ee707ea949b6da010403d595f

SHA256
43e5ea3c942151357f886fb67a624a8680d5d77b0918e86d1f12dc8b016b2b57

SHA512
6a5414d78db98ec51537d481f141c3a280e2b767164e9d5d5e6f29798c06d8bf3f412d3648eee9ad3ea0729cecccea6df5bb442fc6aee0fac3f17f2ba9583bdd

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/firmware.dat

Filesize
71KB

MD5
d34bb0f0364ec1166883f2151c44dca7

SHA1
914fc83631b647cd3bae04d2f22876bd6c7035c2

SHA256
5eeba8b745ae89c4b38a2e4f0cac7620e0fd3baf8dd4959086360f7b77f60c36

SHA512
102bbd7c94639d26ef8a291bca342e93d94db7a51c0d3bf1fc3541e9f224325ecf81801d03f7ac7efacda0208a665646c115b533564aa3926f1245d3b0b747ca

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/fixissues.dat

Filesize
232B

MD5
39789ee8a307af4aad13f0222c46e474

SHA1
b2609c7e9af3d3e5bfa5d2206a5debba18ff366e

SHA256
66fecca2e07d1839c0e500b917ff7c734c3d32a7c1b5097fa1981bea54f79172

SHA512
6890ab297d199912249496e645d75a365779995d1ec0f480c6de72c35a2f7d1469cd1dae4eff8765215ae9cd04da7071644f242f80d59890715bf39c8b8c3c6d

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/iphone-spec.dat

Filesize
238B

MD5
eb1ff886da84ec01e3dbcb1aaa3851ae

SHA1
3187a7a70001d1be7fbb31e4194852049e23097a

SHA256
854c04eb95396f01fbfe237c64080b2ff998358925813486ad26e3b40c40dc76

SHA512
3da9b4dce5a8bb2aad91b65cfdda32cab4c0ccf9fc467c7a349359e7deacf8cfb1ac1dd63caa95798a64d147df9d79fe50e497099d6040d330f8138f112a14ec

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/limitdata.dat

Filesize
385B

MD5
876932be763907343bd2390133556a96

SHA1
d0a044419d9bed589497ac654aefc5b4da76c74c

SHA256
00e2e7463c258c100002b8243d2971ce6086ffeea7ada7a081fea51c1820e4f1

SHA512
905ab60b745de40fe683a1f1bde07997191b0612ce19e14867277f6156722c6c5919d33958459cd2a516966000e0eccb547128e5bad340ec2d0d7bd6404552fb

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/notification.dat

Filesize
238B

MD5
7041f4b57ee1399b02873022536c1c25

SHA1
ec0137b04be8c752ec207f2a1b77d3e53d28ee1e

SHA256
4c33a8dc026213913a49b3033c33edd389e9686c690658797be0069e74779ab0

SHA512
a3ae0b01b7652486a0df3983f47c1da30d22e94b7b18f85e3576cda6eb1451490f01adb1d31e8f224396e7d57fca5ef67a4928dec5d3b9537687beda8ed63a30

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/preferencesconfig.dat

Filesize
442B

MD5
8d53050e41907742a6ca0156e4b9fc10

SHA1
e3299c4b2bf97c69560ec3192c86a8472f23dca9

SHA256
bfa6c0cb7e1cb58812669bd4fb5a7bf8f7a210cdce032afa23a91eaaf18b85ea

SHA512
9dac00f2a3967ab8c361430973a15003bfe4980d16523b95f2f487e6eaff17cdec65a3a92cc79f0f4253ef8b91c872f88c6ccdfdc929ecb3c18cdf8efe7df215

Download Submit
/Users/run/Library/Application Support/Omni Downloader/config/toolbox.dat

Filesize
240B

MD5
5309d78ccec44ee79ea2dc75d57a4ddc

SHA1
3c01100efeba3d895593ae1db0557f35eeebbbc1

SHA256
2a0450eeabf5d12a4ae1a394a26b0be8cf23b9cdb1fb775d9e96a1225ade0530

SHA512
b4d860316b9f5f2c63713e8612ae770754f377f06aedd998f1772428d545f153122e6967ec0f3ea5944304874a404ea5248c23ac9b804f27b0dfe304539039c0

Download Submit
/Users/run/mcglobal/.mcconfig.dat

Filesize
273B

MD5
23ac46529faf013928261135ecf9b502

SHA1
d67946a58cbe25cd34e705cac2e612e16435173e

SHA256
bcbc9107badeeec7038b7e8e4ff3e781bee5179c70e400a6db296cda8313e38a

SHA512
0c25f4bc090256880bac89b6c34ab6c18ad0d8d816795f23d49905c24d3eacc129d4945ddbe46f69533ecd2e5a9d9c422a6f81057ccc10e44f9c03af461b4d04

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit