Analysis

  • max time kernel
    105s
  • max time network
    124s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    21-09-2024 00:00

General

  • Target

    Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/MacOS/LaunchAtLoginHelper

  • Size

    177KB

  • MD5

    50a5a0b4416cc144daa8d5a7cca6a0f7

  • SHA1

    dcf03eda4ba38d8337805e6a13b9a1eef07aee08

  • SHA256

    be27d44c13516e70361dc68986f93ecf18b1dc38071c6eee7529b05a2b1770c6

  • SHA512

    2e3b2b5b88ea464d2b93e72d2e858dd6543301ebf006958915744182870b3f3478dbd179df4e3f015e354e9490cd3110d57c8e9f8099e9f680247e593172f47d

  • SSDEEP

    3072:xGkGZg33b70AR6DW1AxxdGZg33b70AR6DW1AxopjhNGZg33b70AR6DW0GZg33b7a:xDGZg33b70AR6DW1AxxdGZg33b70AR6p

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/MacOS/LaunchAtLoginHelper\""
    1⤵
      PID:514
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/MacOS/LaunchAtLoginHelper\""
      1⤵
        PID:514
      • /usr/bin/sudo
        sudo /bin/zsh -c "/Users/run/Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/MacOS/LaunchAtLoginHelper"
        1⤵
          PID:514
          • /bin/zsh
            /bin/zsh -c "/Users/run/Paste 4.4.0 [MacKed]/Paste.app/Contents/Library/LoginItems/LaunchAtLoginHelper.app/Contents/MacOS/LaunchAtLoginHelper"
            2⤵
              PID:515
          • /usr/libexec/xpcproxy
            xpcproxy com.apple.sysmond
            1⤵
              PID:516
            • /usr/libexec/sysmond
              /usr/libexec/sysmond
              1⤵
                PID:516
              • /usr/libexec/xpcproxy
                xpcproxy com.apple.audio.AudioComponentRegistrar
                1⤵
                  PID:518
                • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                  /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                  1⤵
                    PID:518
                  • /usr/bin/bzip2
                    /usr/bin/bzip2 -f /var/log/wifi.log.0
                    1⤵
                      PID:527
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                      1⤵
                        PID:533
                      • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                        1⤵
                          PID:533
                        • /bin/launchctl
                          /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                          1⤵
                            PID:538
                          • /bin/launchctl
                            /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                            1⤵
                              PID:539

                            Network

                            • flag-us
                              DNS
                              cds.apple.com
                              Remote address:
                              8.8.8.8:53
                              Request
                              cds.apple.com
                              IN A
                              Response
                              cds.apple.com
                              IN CNAME
                              cds-cdn.v.aaplimg.com
                              cds-cdn.v.aaplimg.com
                              IN CNAME
                              cds.apple.com.akadns.net
                              cds.apple.com.akadns.net
                              IN CNAME
                              cds.apple.com.edgekey.net
                              cds.apple.com.edgekey.net
                              IN CNAME
                              e14768.dscb.akamaiedge.net
                              e14768.dscb.akamaiedge.net
                              IN A
                              104.82.128.95
                            • flag-us
                              DNS
                              help.apple.com
                              Remote address:
                              8.8.8.8:53
                              Request
                              help.apple.com
                              IN A
                              Response
                              help.apple.com
                              IN CNAME
                              help.origin-apple.com.akadns.net
                              help.origin-apple.com.akadns.net
                              IN CNAME
                              help-ar.apple.com.edgekey.net
                              help-ar.apple.com.edgekey.net
                              IN CNAME
                              e11408.d.akamaiedge.net
                              e11408.d.akamaiedge.net
                              IN A
                              95.100.245.89
                            • flag-gb
                              GET
                              http://ocsp.apple.com/ocsp03-asi2ca02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFDpjNYC91gD%2BzsNfJ0wP9wrPSi8lBBQSdXxHkv2D474u%2FFl%2FZ0OBNRBF7AIIR5uTR%2BogEsU%3D
                              Remote address:
                              17.253.77.202:80
                              Request
                              GET /ocsp03-asi2ca02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFDpjNYC91gD%2BzsNfJ0wP9wrPSi8lBBQSdXxHkv2D474u%2FFl%2FZ0OBNRBF7AIIR5uTR%2BogEsU%3D HTTP/1.1
                              Host: ocsp.apple.com
                              Accept: */*
                              Accept-Language: en-us
                              Connection: keep-alive
                              Accept-Encoding: gzip, deflate
                              User-Agent: com.apple.trustd/2.0
                              Response
                              HTTP/1.1 200 OK
                              Server: Apple
                              Date: Fri, 20 Sep 2024 22:55:38 GMT
                              Content-Type: application/ocsp-response
                              Content-Length: 2559
                              Expires: Sat, 21 Sep 2024 09:55:38 GMT
                              ETag: "2acd8c5dbc36b0b4b73975eebfda79e8ad7733e5"
                              Last-Modified: Fri, 20 Sep 2024 22:55:38 GMT
                              Age: 4590
                              Via: http/1.1 uklon5-vp-vst-015.ts.apple.com (acdn/255.14450), http/1.1 uklon5-vp-vfe-001.ts.apple.com (acdn/255.14450), http/1.1 gbmnc1-edge-lx-001.ts.apple.com (acdn/255.14450), http/1.1 gbmnc1-edge-bx-004.ts.apple.com (acdn/255.14450)
                              X-Cache: hit-fresh, hit-stale, hit-fresh, hit-fresh
                              CDNUUID: 6dfb77f9-4ba8-404c-8c48-3ef308a6a177-33175947034
                              Connection: keep-alive
                            • 104.82.128.95:443
                              cds.apple.com
                              tls
                              18.6kB
                              165.3kB
                              210
                              204
                            • 95.100.245.89:443
                              help.apple.com
                              tls
                              29.2kB
                              112.6kB
                              159
                              124
                            • 95.100.245.89:443
                              help.apple.com
                              tls
                              1.8kB
                              1.4kB
                              13
                              10
                            • 17.253.77.202:80
                              http://ocsp.apple.com/ocsp03-asi2ca02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFDpjNYC91gD%2BzsNfJ0wP9wrPSi8lBBQSdXxHkv2D474u%2FFl%2FZ0OBNRBF7AIIR5uTR%2BogEsU%3D
                              http
                              677 B
                              3.5kB
                              7
                              6

                              HTTP Request

                              GET http://ocsp.apple.com/ocsp03-asi2ca02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFDpjNYC91gD%2BzsNfJ0wP9wrPSi8lBBQSdXxHkv2D474u%2FFl%2FZ0OBNRBF7AIIR5uTR%2BogEsU%3D

                              HTTP Response

                              200
                            • 8.8.8.8:53
                              cds.apple.com
                              dns
                              59 B
                              218 B
                              1
                              1

                              DNS Request

                              cds.apple.com

                              DNS Response

                              104.82.128.95

                            • 8.8.8.8:53
                              help.apple.com
                              dns
                              60 B
                              196 B
                              1
                              1

                              DNS Request

                              help.apple.com

                              DNS Response

                              95.100.245.89

                            • 224.0.0.251:5353
                              332 B
                              1

                            MITRE ATT&CK Matrix

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            We care about your privacy.

                            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.