1cb6ad7e145fc1ca37eb9007d2338a68d51a5dd960d99a560f1d1eed218c194a | Triage

Analysis

max time kernel
85s
max time network
107s
platform
macos-10.15_amd64
resource
macos-20241101-en
resource tags

arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
03-12-2024 12:23

Sharing

Report Analysis Logs

General

Target

Payload/Spotify.app/Frameworks/libswiftCoreGraphics.dylib
Size

142KB
MD5

e6e50362f8374fbb9a3085dff9e9d57b
SHA1

8c7f2adf7dfeb0892f6ce1d843eed736c780bf52
SHA256

02cb95523df845e026265afebb47ea9f5ad3f21254fa903132ad9ecb104ffca0
SHA512

a2523d4d4a667e908087d951d8eb1c6ac94dbeba78bfa4aa386ce126771a91d0eb6dec140e927d480aed543598f2ad1f08d8d1ce3d3012a89496407b33f6e244
SSDEEP

3072:vk6dCg+GcSGbdzwevmFgPCWHQE6+JdVv:vkgCg+ZSGbdzXPr

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/Spotify.app/Frameworks/libswiftCoreGraphics.dylib\""
1⤵
PID:491

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/Spotify.app/Frameworks/libswiftCoreGraphics.dylib\""
1⤵
PID:491

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Payload/Spotify.app/Frameworks/libswiftCoreGraphics.dylib
1⤵
PID:491
- /bin/zsh
  /bin/zsh -c /Users/run/Payload/Spotify.app/Frameworks/libswiftCoreGraphics.dylib
  2⤵
  PID:492
- /Users/run/Payload/Spotify.app/Frameworks/libswiftCoreGraphics.dylib
  /Users/run/Payload/Spotify.app/Frameworks/libswiftCoreGraphics.dylib
  2⤵
  PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:493

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:493

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/var/db/nsurlstoraged/dafsaData.bin

Filesize
54KB

MD5
64f469698e53d0c828b7f90acd306082

SHA1
bcc041b3849e1b0b4104ffeb46002207eeac54f3

SHA256
d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

SHA512
a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

Download Submit