Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
77s -
platform
macos-10.15_amd64 -
resource
macos-20240711.1-en -
resource tags
-
submitted
31/10/2024, 21:25 UTC
General
-
Target
discord_token_grabber.pyc
-
Size
15KB
-
MD5
aaaeca514d98795f954c1f2eebb18881
-
SHA1
6331352aada5256452c43545bb6593958602a20c
-
SHA256
a808291bd70bbd15bedd818ef25a1dbcfbf548330fd9ddf5244143ec3eb66cc6
-
SHA512
ec9c019d0061103e1e1b3db7feb346136e5e4f447804f9586aacdd7da3c9b877bda1221735b08fc44586cd443b8909664a22bb90ce3a4230402357d35fe80883
-
SSDEEP
384:nGC7RYmnXavkLPJrltcshntQ5Maa2holHVg:nGCuvkL9ltcsttQ5MaaCgHVg
Score
4/10
Malware Config
Signatures
-
Resource Forking 1 TTPs 2 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/discord_token_grabber.pyc\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/discord_token_grabber.pyc\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/discord_token_grabber.pyc1⤵
-
/bin/zsh/bin/zsh -c /Users/run/discord_token_grabber.pyc2⤵
-
-
/Users/run/discord_token_grabber.pyc/Users/run/discord_token_grabber.pyc2⤵
-
-
/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"1⤵
-
/usr/libexec/pkreporter/usr/libexec/pkreporter1⤵
-
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd1⤵
-
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer1⤵
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵
Network
-
DNS13-courier.push.apple.comRemote address:8.8.8.8:53Request13-courier.push.apple.comIN AResponse13-courier.push.apple.comIN CNAME13.courier-push-apple.com.akadns.net13.courier-push-apple.com.akadns.netIN CNAMEgb-courier-4.push-apple.com.akadns.netgb-courier-4.push-apple.com.akadns.netIN A17.57.146.11gb-courier-4.push-apple.com.akadns.netIN A17.57.146.8gb-courier-4.push-apple.com.akadns.netIN A17.57.146.10gb-courier-4.push-apple.com.akadns.netIN A17.57.146.9gb-courier-4.push-apple.com.akadns.netIN A17.57.146.13gb-courier-4.push-apple.com.akadns.netIN A17.57.146.12gb-courier-4.push-apple.com.akadns.netIN A17.57.146.7 -
DNS12-courier.push.apple.comRemote address:8.8.8.8:53Request12-courier.push.apple.comIN AResponse12-courier.push.apple.comIN CNAME12.courier-push-apple.com.akadns.net12.courier-push-apple.com.akadns.netIN CNAMEgb-courier-4.push-apple.com.akadns.netgb-courier-4.push-apple.com.akadns.netIN A17.57.146.9gb-courier-4.push-apple.com.akadns.netIN A17.57.146.7gb-courier-4.push-apple.com.akadns.netIN A17.57.146.8gb-courier-4.push-apple.com.akadns.netIN A17.57.146.12gb-courier-4.push-apple.com.akadns.netIN A17.57.146.11gb-courier-4.push-apple.com.akadns.netIN A17.57.146.13gb-courier-4.push-apple.com.akadns.netIN A17.57.146.10
-
DNS42-courier.push.apple.comRemote address:8.8.8.8:53Request42-courier.push.apple.comIN AResponse42-courier.push.apple.comIN CNAME42.courier-push-apple.com.akadns.net42.courier-push-apple.com.akadns.netIN CNAMEgb-courier-4.push-apple.com.akadns.netgb-courier-4.push-apple.com.akadns.netIN A17.57.146.154gb-courier-4.push-apple.com.akadns.netIN A17.57.146.151gb-courier-4.push-apple.com.akadns.netIN A17.57.146.155gb-courier-4.push-apple.com.akadns.netIN A17.57.146.148gb-courier-4.push-apple.com.akadns.netIN A17.57.146.153gb-courier-4.push-apple.com.akadns.netIN A17.57.146.152gb-courier-4.push-apple.com.akadns.netIN A17.57.146.150
-
DNS19-courier.push.apple.comRemote address:8.8.8.8:53Request19-courier.push.apple.comIN AResponse19-courier.push.apple.comIN CNAME19.courier-push-apple.com.akadns.net19.courier-push-apple.com.akadns.netIN CNAMEgb-courier-4.push-apple.com.akadns.netgb-courier-4.push-apple.com.akadns.netIN A17.57.146.9gb-courier-4.push-apple.com.akadns.netIN A17.57.146.10gb-courier-4.push-apple.com.akadns.netIN A17.57.146.8gb-courier-4.push-apple.com.akadns.netIN A17.57.146.12gb-courier-4.push-apple.com.akadns.netIN A17.57.146.13gb-courier-4.push-apple.com.akadns.netIN A17.57.146.7gb-courier-4.push-apple.com.akadns.netIN A17.57.146.11
-
DNS6-courier.push.apple.comRemote address:8.8.8.8:53Request6-courier.push.apple.comIN AResponse6-courier.push.apple.comIN CNAME6.courier-push-apple.com.akadns.net6.courier-push-apple.com.akadns.netIN CNAMEgb-courier-4.push-apple.com.akadns.netgb-courier-4.push-apple.com.akadns.netIN A17.57.146.11gb-courier-4.push-apple.com.akadns.netIN A17.57.146.8gb-courier-4.push-apple.com.akadns.netIN A17.57.146.9gb-courier-4.push-apple.com.akadns.netIN A17.57.146.13gb-courier-4.push-apple.com.akadns.netIN A17.57.146.12gb-courier-4.push-apple.com.akadns.netIN A17.57.146.7gb-courier-4.push-apple.com.akadns.netIN A17.57.146.10
-
DNS46-courier.push.apple.comRemote address:8.8.8.8:53Request46-courier.push.apple.comIN AResponse46-courier.push.apple.comIN CNAME46.courier-push-apple.com.akadns.net46.courier-push-apple.com.akadns.netIN CNAMEgb-courier-4.push-apple.com.akadns.netgb-courier-4.push-apple.com.akadns.netIN A17.57.146.151gb-courier-4.push-apple.com.akadns.netIN A17.57.146.153gb-courier-4.push-apple.com.akadns.netIN A17.57.146.154gb-courier-4.push-apple.com.akadns.netIN A17.57.146.148gb-courier-4.push-apple.com.akadns.netIN A17.57.146.150gb-courier-4.push-apple.com.akadns.netIN A17.57.146.155gb-courier-4.push-apple.com.akadns.netIN A17.57.146.152
-
DNS37.courier-push-apple.com.akadns.netRemote address:8.8.8.8:53Request37.courier-push-apple.com.akadns.netIN A
-
DNS32.courier-push-apple.com.akadns.netRemote address:8.8.8.8:53Request32.courier-push-apple.com.akadns.netIN A
-
184.85.51.234:443tls, https -
2.18.109.84:443tls, https
-
17.57.146.152:522346-courier.push.apple.com
-
17.57.146.153:522346-courier.push.apple.com
-
8.8.8.8:5313-courier.push.apple.comdns
DNS Request
13-courier.push.apple.com
DNS Response
17.57.146.1117.57.146.817.57.146.1017.57.146.917.57.146.1317.57.146.1217.57.146.7
-
8.8.8.8:5312-courier.push.apple.comdns
DNS Request
12-courier.push.apple.com
DNS Response
17.57.146.917.57.146.717.57.146.817.57.146.1217.57.146.1117.57.146.1317.57.146.10
-
8.8.8.8:5342-courier.push.apple.comdns
DNS Request
42-courier.push.apple.com
DNS Response
17.57.146.15417.57.146.15117.57.146.15517.57.146.14817.57.146.15317.57.146.15217.57.146.150
-
8.8.8.8:5319-courier.push.apple.comdns
DNS Request
19-courier.push.apple.com
DNS Response
17.57.146.917.57.146.1017.57.146.817.57.146.1217.57.146.1317.57.146.717.57.146.11
-
8.8.8.8:536-courier.push.apple.comdns
DNS Request
6-courier.push.apple.com
DNS Response
17.57.146.1117.57.146.817.57.146.917.57.146.1317.57.146.1217.57.146.717.57.146.10
-
8.8.8.8:5346-courier.push.apple.comdns
DNS Request
46-courier.push.apple.com
DNS Response
17.57.146.15117.57.146.15317.57.146.15417.57.146.14817.57.146.15017.57.146.15517.57.146.152
-
8.8.8.8:5337.courier-push-apple.com.akadns.netdns
DNS Request
37.courier-push-apple.com.akadns.net
-
8.8.8.8:5332.courier-push-apple.com.akadns.netdns
DNS Request
32.courier-push-apple.com.akadns.net