59e1e4131c846fa9e2e994d2757fb405cc1b06231dac274cf6acea987a4288fa

Analysis

max time kernel
1629s
max time network
1804s
platform
macos-10.15_amd64
resource
macos-20241106-en
resource tags

arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
03/12/2024, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html
Size

13KB
MD5

a63b04371a9605e437d99e8db5cfea9b
SHA1

39457d5ae31cf847006fb263ec74e7f6cdd38cd7
SHA256

be5b4678af2015842cce22f81860ace20128e6dd8b3a0b69e41c15289ef227df
SHA512

6be878f85d82f2bcd6d4c6e28bc86ff99127d1c9042e0640d7dea33c1f214b3ed072530aaa4467396a7e83a28835a207323f654cb4e62d06cd5a037e003df7f3
SSDEEP

384:qz/tITGSlnbGKY79IKc+7c9sEppI/TrpsHY+vaJ3NFmsGJvJEWi8dS7:qz/tITGSlnbKg4qHva/6EW47

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/bin/zsh -c /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html	Process not Found
/Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html	Process not Found
sh /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html	Process not Found
sh -c "sudo /bin/zsh -c \"/Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html\""	Process not Found
sudo /bin/zsh -c /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html\""
1⤵
PID:489

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html\""
1⤵
PID:489

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html
1⤵
PID:489
- /bin/zsh
  /bin/zsh -c /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html
  2⤵
  PID:490
- /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html
  /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html
  2⤵
  PID:490
- /bin/sh
  sh /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html
  2⤵
  PID:490
- /bin/bash
  sh /Users/run/AstraLife/AstraLife.app/Contents/Resources/app/node_modules/npm/docs/output/commands/npm-run-script.html
  2⤵
  PID:490

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:510

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:510

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads