af5c84e1fdc8ba08e649c410973925457d513d67c01b8dd7c9644ecd6cc33fde

Reason

Machine shutdown

General

Target

fuckumac1
Size

13.5MB
MD5

7e5e3bf33374cb1499752dee4795f166
SHA1

405246f69abc62cbe0cfacccc8b9507bf0dc8ab6
SHA256

af5c84e1fdc8ba08e649c410973925457d513d67c01b8dd7c9644ecd6cc33fde
SHA512

3be4bcc2b0db67539e46b3a2a28fe586edfa5f8a81b0cad4ee4b7dd6da0b9f688943593dbf421d5befa6da23cc44b59aff1487d93329e9290e127c9564c1469c
SSDEEP

98304:4EPXzeCcr9tV7ou06zCjyoE+ptb3yJMJXRSSH+XD4O57xSUrvDAqUMgHR2E4EO+3:ZjeBJio2yJfbkONxSeRUzx2EJZ

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 3 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/fuckumac1\""
1⤵
PID:456

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/fuckumac1\""
1⤵
PID:456

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/fuckumac1
1⤵
PID:456
- /bin/zsh
  /bin/zsh -c /Users/run/fuckumac1
  2⤵
  PID:459
- /Users/run/fuckumac1
  /Users/run/fuckumac1
  2⤵
  PID:459

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:452

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:445

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:443

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:448

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:454

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:489

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:489

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:494

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:494

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.1D87D4E5-67AA-41D3-AF14-FA7DFA9476A6 482
1⤵
PID:495

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:495

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:496

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:498

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:498
- /usr/bin/login
  login -pf run
  2⤵
  PID:500
- - /bin/zsh
    -zsh
    3⤵
    PID:501
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:502
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:503
  - - /sbin/md5
      md5 /Users/run/fuckumac1
      4⤵
      PID:511
- /usr/bin/login
  login -pf run
  2⤵
  PID:504
- - /bin/zsh
    -zsh
    3⤵
    PID:505
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:506
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:507
  - - /Users/run/fuckumac1
      /Users/run/fuckumac1
      4⤵
      PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:510

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:514

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.openAndSavePanelService 282
1⤵
PID:516

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.QuickLookUIService 516
1⤵
PID:517

/System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
/System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.automountd
1⤵
PID:518

/usr/libexec/automountd
automountd
1⤵
PID:518
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:521

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook
1⤵
PID:522

/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.ABB97DC6-0004-467F-9830-BEA2BBDF8667 522
1⤵
PID:523

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:523

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/private/var/db/spindump/tailspin-trace.2024-12-03_23-45-10.tailspin

Filesize
17.6MB

MD5
e39d7631426f981c357082839e95609c

SHA1
4a362ca3f5067d63855abc919d80dbc188f06ebc

SHA256
b242b0a6f2098ca0e9b1fd6ffa4d37f9bebecb300ecfafd846fdaf9b9230b52f

SHA512
186c2c53c0a0bfeb3372ca23a4a95e78f5eaa0807064465faf2874cdb60126056e21fafbea835fcfcd6cc3d47c4749c04f63a55f0592a956aebce5fc1266b46e

Download Submit
/var/db/nsurlstoraged/dafsaData.bin

Filesize
54KB

MD5
64f469698e53d0c828b7f90acd306082

SHA1
bcc041b3849e1b0b4104ffeb46002207eeac54f3

SHA256
d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

SHA512
a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

Download Submit

Resubmissions

Analysis

Sharing

Errors