Overview

overview

10

Static

static

10

payload.bin

macos-10.15-amd64

7

Analysis

  • max time kernel
    358s
  • max time network
    1200s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241106-en
  • resource tags

    arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    03-12-2024 17:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    payload.bin

  • Size

    795KB

  • MD5

    02690d5154f0fa29c596f0f965b188d5

  • SHA1

    7cc50836089fd178e8a013f2a6f241ec4b98ab1a

  • SHA256

    4cebdd2efb22f53d626a208b67ac35fd27a387e19b13a369d96dbac7fef5844d

  • SHA512

    af22a0b9ade3472ef44fa21c21a0396b9151d7f396af5ee0cb3d67e3dd5c4ba14ab188cfb72a6894dd0f376f7bf676ebbab09a31a22f987597846d4df3f38d99

  • SSDEEP

    24576:oFyOeWZxXXqurwayuStT6GWSPw/1nntuf2:oFyOBBrUtTESPw/1tC

Score
7/10
discovery

Malware Config

Signatures

  • Queries the macOS version information. 1 TTPs 4 IoCs

    An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

    discovery

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/payload.bin\""
    1⤵
      PID:456
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/payload.bin\""
      1⤵
        PID:456
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/payload.bin
        1⤵
          PID:456
          • /bin/zsh
            /bin/zsh -c /Users/run/payload.bin
            2⤵
              PID:457
            • /Users/run/payload.bin
              /Users/run/payload.bin
              2⤵
                PID:457
            • /bin/sh
              sh -c "/usr/bin/sw_vers -productVersion"
              1⤵
                PID:459
              • /bin/bash
                sh -c "/usr/bin/sw_vers -productVersion"
                1⤵
                  PID:459
                • /usr/bin/sw_vers
                  /usr/bin/sw_vers -productVersion
                  1⤵
                    PID:459
                  • /bin/sh
                    sh -c "/usr/bin/sw_vers -productVersion"
                    1⤵
                      PID:463
                    • /bin/bash
                      sh -c "/usr/bin/sw_vers -productVersion"
                      1⤵
                        PID:463
                      • /usr/bin/sw_vers
                        /usr/bin/sw_vers -productVersion
                        1⤵
                          PID:463
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.nsurlstoraged
                          1⤵
                            PID:490
                          • /usr/libexec/nsurlstoraged
                            /usr/libexec/nsurlstoraged --privileged
                            1⤵
                              PID:490
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.spindump
                              1⤵
                                PID:498
                              • /usr/sbin/spindump
                                /usr/sbin/spindump
                                1⤵
                                  PID:498
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.diagnosticd
                                  1⤵
                                    PID:499
                                  • /usr/libexec/diagnosticd
                                    /usr/libexec/diagnosticd
                                    1⤵
                                      PID:499

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • /var/db/nsurlstoraged/dafsaData.bin
                                      Filesize

                                      54KB

                                      MD5

                                      64f469698e53d0c828b7f90acd306082

                                      SHA1

                                      bcc041b3849e1b0b4104ffeb46002207eeac54f3

                                      SHA256

                                      d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

                                      SHA512

                                      a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

                                      Download Submit