1cb6ad7e145fc1ca37eb9007d2338a68d51a5dd960d99a560f1d1eed218c194a | Triage

Analysis

max time kernel
84s
max time network
105s
platform
macos-10.15_amd64
resource
macos-20241106-en
resource tags

arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
03/12/2024, 12:23

Sharing

Report Analysis Logs

General

Target

Payload/Spotify.app/Frameworks/libswiftCoreAudio.dylib
Size

78KB
MD5

6fc9990575c0f0d08784b05ff661e457
SHA1

6593634b8d3ac8c4478173b9a3dc153d68c99075
SHA256

514453677811199843b08db261d284509dd95f312a8f09fc57c6bc63f493a609
SHA512

f0e95f1984a844943de04a6805543bb8b2fa3c93ed74574b7b68c818ff3e23587057e446b95caf1cd79f5bd0e28ee16307879735d2f2c79e75b28e9845b1a96f
SSDEEP

768:dIo738DXEzR9TpB6uu5Z5Z5BWpHz9OL4XTmDMKi8t:p7sDXEzR9TpBl99OL4XTmC

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/Spotify.app/Frameworks/libswiftCoreAudio.dylib\""
1⤵
PID:481

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/Spotify.app/Frameworks/libswiftCoreAudio.dylib\""
1⤵
PID:481

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Payload/Spotify.app/Frameworks/libswiftCoreAudio.dylib
1⤵
PID:481
- /bin/zsh
  /bin/zsh -c /Users/run/Payload/Spotify.app/Frameworks/libswiftCoreAudio.dylib
  2⤵
  PID:482
- /Users/run/Payload/Spotify.app/Frameworks/libswiftCoreAudio.dylib
  /Users/run/Payload/Spotify.app/Frameworks/libswiftCoreAudio.dylib
  2⤵
  PID:482

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:494

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:494

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/var/db/nsurlstoraged/dafsaData.bin

Filesize
54KB

MD5
64f469698e53d0c828b7f90acd306082

SHA1
bcc041b3849e1b0b4104ffeb46002207eeac54f3

SHA256
d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

SHA512
a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

Download Submit