Overview
overview
7Static
static
1superpriva...ak.zip
windows7-x64
1superpriva...ak.zip
windows10-2004-x64
1Payload/Ma...2x.png
windows7-x64
3Payload/Ma...2x.png
windows10-2004-x64
3Payload/Ma...ad.png
windows7-x64
3Payload/Ma...ad.png
windows10-2004-x64
3Payload/Ma...ts.car
windows7-x64
3Payload/Ma...ts.car
windows10-2004-x64
3Payload/Ma...ed.otf
windows7-x64
4Payload/Ma...ed.otf
windows10-2004-x64
7Payload/Ma...ht.otf
windows7-x64
4Payload/Ma...ht.otf
windows10-2004-x64
7Payload/Ma...ed.otf
windows7-x64
4Payload/Ma...ed.otf
windows10-2004-x64
7Payload/Ma...ic.otf
windows7-x64
4Payload/Ma...ic.otf
windows10-2004-x64
7Payload/Ma...ed.otf
windows7-x64
4Payload/Ma...ed.otf
windows10-2004-x64
7Payload/Ma....plist
windows7-x64
3Payload/Ma....plist
windows10-2004-x64
3Payload/Mabz.app/Mabz
macos-10.15-amd64
1Payload/Ma...bz.bak
macos-10.15-amd64
1Payload/Ma....plist
windows7-x64
3Payload/Ma....plist
windows10-2004-x64
3Payload/Ma...a.json
windows7-x64
3Payload/Ma...a.json
windows10-2004-x64
3Payload/Ma...kgInfo
windows7-x64
1Payload/Ma...kgInfo
windows10-2004-x64
1Payload/Ma.../CAREx
macos-10.15-amd64
1Payload/Ma....plist
windows7-x64
3Payload/Ma....plist
windows10-2004-x64
3Payload/Ma...es.xml
windows7-x64
3Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 23:51
Static task
static1
Behavioral task
behavioral1
Sample
superprivatedontleak.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
superprivatedontleak.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Payload/Mabz.app/AppIcon76x76@2x~ipad.png
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Payload/Mabz.app/AppIcon76x76@2x~ipad.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Payload/Mabz.app/Assets.car
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Payload/Mabz.app/Assets.car
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Payload/Mabz.app/CashMarket-BoldRounded.otf
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Payload/Mabz.app/CashMarket-BoldRounded.otf
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Payload/Mabz.app/CashMarket-Light.otf
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Payload/Mabz.app/CashMarket-Light.otf
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Payload/Mabz.app/CashMarket-MediumRounded.otf
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
Payload/Mabz.app/CashMarket-MediumRounded.otf
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Payload/Mabz.app/CashMarket-RegularItalic.otf
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Payload/Mabz.app/CashMarket-RegularItalic.otf
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Payload/Mabz.app/CashMarket-RegularRounded.otf
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Payload/Mabz.app/CashMarket-RegularRounded.otf
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Payload/Mabz.app/Info.plist
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Payload/Mabz.app/Info.plist
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Payload/Mabz.app/Mabz
Resource
macos-20240711.1-en
Behavioral task
behavioral22
Sample
Payload/Mabz.app/Mabz.bak
Resource
macos-20240711.1-en
Behavioral task
behavioral23
Sample
Payload/Mabz.app/PhoneNumberKit_PhoneNumberKit.bundle/Info.plist
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Payload/Mabz.app/PhoneNumberKit_PhoneNumberKit.bundle/Info.plist
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Payload/Mabz.app/PhoneNumberKit_PhoneNumberKit.bundle/PhoneNumberMetadata.json
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Payload/Mabz.app/PhoneNumberKit_PhoneNumberKit.bundle/PhoneNumberMetadata.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Payload/Mabz.app/PkgInfo
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
Payload/Mabz.app/PkgInfo
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/CAREx
Resource
macos-20240711.1-en
Behavioral task
behavioral30
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/Info.plist
Resource
win7-20241010-en
Behavioral task
behavioral31
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/Info.plist
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/_CodeSignature/CodeResources.xml
Resource
win7-20240708-en
General
-
Target
superprivatedontleak.zip
-
Size
15.8MB
-
MD5
78cd09fc014a93fc918b58893079c2d7
-
SHA1
359d210fc60a7dcd2ed43c9ae30768f572f86bd7
-
SHA256
39eed41a282105d827a5ed1c6bd0e50e5b69d8535f80c2e67aeb2f0da72e1628
-
SHA512
20b391d9d3a58896efe2682b6b7d62179ec7dbbf41b554ba7b98f46e4b2389815c9b0699444a2474a178af2c1e2f5b0a8dd8505a80123fdc95d0d349d2bf9b74
-
SSDEEP
393216:K3LNyK57G3YNyKxUfdfS37zBJlPFVrSV84Ka/VLIg:K3RyGG3wy/d6r1rNZSVxKa/N
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2300 7zFM.exe Token: 35 2300 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2300 7zFM.exe