Overview

overview

3

Static

static

1

one tap.png

windows11-21h2-x64

3

one tap.png

android-11-x64

one tap.png

macos-10.15-amd64

1

one tap.png

debian-12-armhf

one tap.png

ubuntu-24.04-amd64

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    02/10/2024, 15:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    one tap.png

  • Size

    546KB

  • MD5

    750bbbee35eabd996250aa2af03bc3e6

  • SHA1

    8dc9a889efafcdf20451e288ca6da8acd5a291c2

  • SHA256

    ac8109bed88394f6b0afb7704476a4e86b144b6a594a9147cdb7017b6d49251b

  • SHA512

    41afb707d50fecededc53f7ec348a2102184701b13fb137df895efc5a8963c4fda936c8b9db9f3ec7c1a8d03043dcd9fd3df3968290bbb207c163bcf0c3eeb00

  • SSDEEP

    12288:hMJPVDhj1mau+IdGlAaxjrAfq+9TMpPpP9Bj7ZLW4573xrEyYw9G4PO:hOPVdpigtL4MXHj7Z1/tk

Score
1/10

Malware Config

Signatures

Processes

  • /usr/libexec/xpcproxy
    xpcproxy com.apple.newsyslog
    1⤵
      PID:483
    • /usr/sbin/newsyslog
      /usr/sbin/newsyslog
      1⤵
        PID:483
      • /bin/sh
        sh -c "sudo /bin/zsh -c \"/Users/run/one tap.png\""
        1⤵
          PID:484
        • /bin/bash
          sh -c "sudo /bin/zsh -c \"/Users/run/one tap.png\""
          1⤵
            PID:484
          • /usr/bin/sudo
            sudo /bin/zsh -c "/Users/run/one tap.png"
            1⤵
              PID:484
              • /bin/zsh
                /bin/zsh -c "/Users/run/one tap.png"
                2⤵
                  PID:486
                • /Users/run/one
                  /Users/run/one tap.png
                  2⤵
                    PID:486
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                  1⤵
                    PID:528
                  • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                    /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                    1⤵
                      PID:528
                    • /bin/launchctl
                      /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                      1⤵
                        PID:529
                      • /bin/launchctl
                        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                        1⤵
                          PID:530

                        Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads