Overview

overview

10

Static

static

3

e284b1829c...54.exe

windows7-x64

10

e284b1829c...54.exe

windows10-2004-x64

10

e284b1829c...54.exe

macos-10.15-amd64

4

e284b1829c...54.exe

ubuntu-18.04-amd64

e284b1829c...54.exe

debian-9-armhf

e284b1829c...54.exe

debian-9-mips

e284b1829c...54.exe

debian-9-mipsel

Resubmissions

21/11/2024, 22:49

241121-2rmqgsyncx10

21/11/2024, 22:48

241121-2q8xbsyncv10

21/11/2024, 22:47

241121-2q17gsynb110

21/11/2024, 20:46

241121-zkkw7sxnbv10

Analysis

  • max time kernel
    1269s
  • max time network
    1801s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241106-en
  • resource tags

    arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    21/11/2024, 22:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e284b1829c0e0502ed5051933375c0b35c67c4f134e3122abcdf1de91cc20a54.exe
  • Size 460KB
  • Sample241121-2rmqgsyncx
  • SHA256 e284b1829c0e0502ed5051933375c0b35c67c4f134e3122abcdf1de91cc20a54
  • MD5 SHA1 SHA512 SSDEEP
Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/e284b1829c0e0502ed5051933375c0b35c67c4f134e3122abcdf1de91cc20a54.exe\""
    1⤵
      PID:464
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/e284b1829c0e0502ed5051933375c0b35c67c4f134e3122abcdf1de91cc20a54.exe\""
      1⤵
        PID:464
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/e284b1829c0e0502ed5051933375c0b35c67c4f134e3122abcdf1de91cc20a54.exe
        1⤵
          PID:464
          • /bin/zsh
            /bin/zsh -c /Users/run/e284b1829c0e0502ed5051933375c0b35c67c4f134e3122abcdf1de91cc20a54.exe
            2⤵
              PID:466
            • /Users/run/e284b1829c0e0502ed5051933375c0b35c67c4f134e3122abcdf1de91cc20a54.exe
              /Users/run/e284b1829c0e0502ed5051933375c0b35c67c4f134e3122abcdf1de91cc20a54.exe
              2⤵
                PID:466
            • /usr/libexec/pkreporter
              /usr/libexec/pkreporter
              1⤵
                PID:453
              • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                1⤵
                  PID:456
                • /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
                  "/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
                  1⤵
                    PID:448
                  • /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                    /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                    1⤵
                      PID:450
                    • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                      "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                      1⤵
                        PID:458
                      • /usr/bin/bzip2
                        /usr/bin/bzip2 -f /var/log/wifi.log.0
                        1⤵
                          PID:492
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.spindump
                          1⤵
                            PID:505
                          • /usr/sbin/spindump
                            /usr/sbin/spindump
                            1⤵
                              PID:505
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.diagnosticd
                              1⤵
                                PID:506
                              • /usr/libexec/diagnosticd
                                /usr/libexec/diagnosticd
                                1⤵
                                  PID:506
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.systemstats.daily
                                  1⤵
                                    PID:507
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.newsyslog
                                    1⤵
                                      PID:508
                                    • /usr/sbin/newsyslog
                                      /usr/sbin/newsyslog
                                      1⤵
                                        PID:508
                                      • /usr/bin/bzip2
                                        /usr/bin/bzip2 -f /var/log/wifi.log.0
                                        1⤵
                                          PID:509

                                        Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              wifi.log.0
                                              • Path /var/log/wifi.log.0
                                              • Size 126B
                                              • SHA256 db4361e25fa58793d0238f9d7ff25296b9b0a4e9e42aae8670b2a8c638096dbe
                                              • MD5 SHA1 SHA512
                                              Submit Download