Overview

overview

1

Static

static

1

zbxl.zip

macos-10.15-amd64

1

Analysis

  • max time kernel
    662s
  • max time network
    1053s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    20-10-2024 18:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    zbxl.zip

  • Size

    43.8MB

  • MD5

    da596c5fa1bfe53dc6ef777e810c2e7d

  • SHA1

    dc756fddd264eaadcc0c8e8576d11259bbe1c150

  • SHA256

    eafd8f574ea7fd0f345eaa19eae8d0d78d5323c8154592c850a2d78a86817744

  • SHA512

    bb7a10c4d9decee9687dfba5987939d1f55c3966bd80d06103d4bde6f61df3957d89392ac185b96ac668bc794193319dad33e34dde199df91eb2981e7e5f9fc3

  • SSDEEP

    196608:rAA/coo9ZmMOfGI0QIdgCUlo1JKq5LJ2q82M/nSk827:rAHX9DQGI0Q321tr82MPl

Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/zbxl.zip\""
    1⤵
      PID:485
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/zbxl.zip\""
      1⤵
        PID:485
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/zbxl.zip
        1⤵
          PID:485
          • /bin/zsh
            /bin/zsh -c /Users/run/zbxl.zip
            2⤵
              PID:489
            • /Users/run/zbxl.zip
              /Users/run/zbxl.zip
              2⤵
                PID:489
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.audio.AudioComponentRegistrar
              1⤵
                PID:514
              • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                1⤵
                  PID:514
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.Terminal.2100
                  1⤵
                    PID:525
                  • /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                    /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                    1⤵
                      PID:525
                      • /usr/bin/login
                        login -pf run
                        2⤵
                          PID:527
                          • /bin/zsh
                            -zsh
                            3⤵
                              PID:528
                              • /usr/libexec/path_helper
                                /usr/libexec/path_helper -s
                                4⤵
                                  PID:529
                                • /usr/bin/locale
                                  locale LC_CTYPE
                                  4⤵
                                    PID:530
                                  • /usr/local/bin/soltaire
                                    soltaire
                                    4⤵
                                      PID:533
                                    • /usr/bin/soltaire
                                      soltaire
                                      4⤵
                                        PID:533
                                      • /bin/soltaire
                                        soltaire
                                        4⤵
                                          PID:533
                                        • /usr/sbin/soltaire
                                          soltaire
                                          4⤵
                                            PID:533
                                          • /sbin/soltaire
                                            soltaire
                                            4⤵
                                              PID:533
                                            • /usr/local/bin/ahhhhhh
                                              ahhhhhh
                                              4⤵
                                                PID:534
                                              • /usr/bin/ahhhhhh
                                                ahhhhhh
                                                4⤵
                                                  PID:534
                                                • /bin/ahhhhhh
                                                  ahhhhhh
                                                  4⤵
                                                    PID:534
                                                  • /usr/sbin/ahhhhhh
                                                    ahhhhhh
                                                    4⤵
                                                      PID:534
                                                    • /sbin/ahhhhhh
                                                      ahhhhhh
                                                      4⤵
                                                        PID:534
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.spindump
                                                  1⤵
                                                    PID:546
                                                  • /usr/sbin/spindump
                                                    /usr/sbin/spindump
                                                    1⤵
                                                      PID:546
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.diagnosticd
                                                      1⤵
                                                        PID:547
                                                      • /usr/libexec/diagnosticd
                                                        /usr/libexec/diagnosticd
                                                        1⤵
                                                          PID:547

                                                        Network

                                                        MITRE ATT&CK Matrix

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • /dev/ttys000
                                                          MD5

                                                          d41d8cd98f00b204e9800998ecf8427e

                                                          SHA1

                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                          SHA256

                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                          SHA512

                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                          Download Submit