Overview

overview

8

Static

static

1

3803279044...8.scpt

macos-10.15-amd64

8

Analysis

  • max time kernel
    138s
  • max time network
    104s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241101-en
  • resource tags

    arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    21-11-2024 04:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3803279044bccd2aaa4ce2d71960ef60e5fa99ff159975cc506096ee2fec4218.scpt

  • Size

    17KB

  • MD5

    1f77f846d3014a6b91e7ba601cec7512

  • SHA1

    51ef05c84eea3dde149a5dd3ea9916a824e95afc

  • SHA256

    3803279044bccd2aaa4ce2d71960ef60e5fa99ff159975cc506096ee2fec4218

  • SHA512

    6bd8757179b736a239fbd2e5f4e3bdbee52d4d47a968b672ae0d1db5c9c366cd77c1232cf5f99079fdc5bed6abe8985acc25918c5af18891d1833b59aa763c7e

  • SSDEEP

    192:SK4zm3TnXEgm3TytbVrT+iiMQuCPX8zYDLsw8IWYgoc30OZb1bFE96MRk+02Og0o:SDUVRaUsYw8hqGbFE96Yk+Lu1Dhk0W7

Score
8/10

Malware Config

Signatures

  • Identifies hardware specifics through system_profiler 2 IoCs

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"osascript /Users/run/3803279044bccd2aaa4ce2d71960ef60e5fa99ff159975cc506096ee2fec4218.scpt\""
    1⤵
      PID:476
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"osascript /Users/run/3803279044bccd2aaa4ce2d71960ef60e5fa99ff159975cc506096ee2fec4218.scpt\""
      1⤵
        PID:476
      • /usr/bin/sudo
        sudo /bin/zsh -c "osascript /Users/run/3803279044bccd2aaa4ce2d71960ef60e5fa99ff159975cc506096ee2fec4218.scpt"
        1⤵
          PID:476
          • /bin/zsh
            /bin/zsh -c "osascript /Users/run/3803279044bccd2aaa4ce2d71960ef60e5fa99ff159975cc506096ee2fec4218.scpt"
            2⤵
              PID:477
            • /usr/bin/osascript
              osascript /Users/run/3803279044bccd2aaa4ce2d71960ef60e5fa99ff159975cc506096ee2fec4218.scpt
              2⤵
                PID:477
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.Terminal.1804
              1⤵
                PID:481
              • /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                1⤵
                  PID:481
                  • /usr/bin/login
                    login -pf run
                    2⤵
                      PID:484
                      • /bin/zsh
                        -zsh
                        3⤵
                          PID:487
                          • /usr/libexec/path_helper
                            /usr/libexec/path_helper -s
                            4⤵
                              PID:488
                            • /usr/bin/locale
                              locale LC_CTYPE
                              4⤵
                                PID:489
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.audio.systemsoundserverd
                          1⤵
                            PID:485
                          • /usr/sbin/systemsoundserverd
                            /usr/sbin/systemsoundserverd
                            1⤵
                              PID:485
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.AccountPolicyHelper
                              1⤵
                                PID:486
                              • /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
                                /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
                                1⤵
                                  PID:486
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.audio.AudioComponentRegistrar
                                  1⤵
                                    PID:490
                                  • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                                    /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                                    1⤵
                                      PID:490
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.sysmond
                                      1⤵
                                        PID:515
                                      • /usr/libexec/sysmond
                                        /usr/libexec/sysmond
                                        1⤵
                                          PID:515
                                        • /bin/sh
                                          sh -c "echo \$((RANDOM % 9000 + 1000))"
                                          1⤵
                                            PID:521
                                          • /bin/bash
                                            sh -c "echo \$((RANDOM % 9000 + 1000))"
                                            1⤵
                                              PID:521
                                            • /bin/sh
                                              sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
                                              1⤵
                                                PID:522
                                              • /bin/bash
                                                sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
                                                1⤵
                                                  PID:522
                                                • /usr/sbin/system_profiler
                                                  system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
                                                  1⤵
                                                    PID:522
                                                  • /usr/bin/csrutil
                                                    /usr/bin/csrutil status
                                                    1⤵
                                                      PID:524
                                                    • /bin/sh
                                                      sh -c "mkdir -p '/tmp/4424'"
                                                      1⤵
                                                        PID:527
                                                      • /bin/bash
                                                        sh -c "mkdir -p '/tmp/4424'"
                                                        1⤵
                                                          PID:527
                                                        • /bin/mkdir
                                                          mkdir -p /tmp/4424
                                                          1⤵
                                                            PID:527
                                                          • /bin/sh
                                                            sh -c "dscl . authonly 'root' ''"
                                                            1⤵
                                                              PID:528
                                                            • /bin/bash
                                                              sh -c "dscl . authonly 'root' ''"
                                                              1⤵
                                                                PID:528
                                                              • /usr/bin/dscl
                                                                dscl . authonly root
                                                                1⤵
                                                                  PID:528
                                                                • /usr/libexec/xpcproxy
                                                                  xpcproxy com.apple.ViewBridgeAuxiliary
                                                                  1⤵
                                                                    PID:530
                                                                  • /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                                                    /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                                                    1⤵
                                                                      PID:530

                                                                    Network

                                                                    MITRE ATT&CK Matrix

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • /dev/ttys000
                                                                      MD5

                                                                      d41d8cd98f00b204e9800998ecf8427e

                                                                      SHA1

                                                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                      SHA256

                                                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                      SHA512

                                                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                      Download Submit