Overview
overview
6Static
static
6CapCut.zip
windows7-x64
1CapCut.zip
windows10-2004-x64
1Payload/Ca...API.js
windows7-x64
3Payload/Ca...API.js
windows10-2004-x64
3Payload/Ca...nfo.js
windows7-x64
3Payload/Ca...nfo.js
windows10-2004-x64
3Payload/Ca...dge.js
windows7-x64
3Payload/Ca...dge.js
windows10-2004-x64
3Payload/Ca...ore.js
windows7-x64
3Payload/Ca...ore.js
windows10-2004-x64
3Payload/Ca...-v1.js
windows7-x64
3Payload/Ca...-v1.js
windows10-2004-x64
3Payload/Ca...cation
macos-10.15-amd64
1Payload/Ca...ension
macos-10.15-amd64
1Payload/Ca...st.xml
windows7-x64
3Payload/Ca...st.xml
windows10-2004-x64
1Payload/Ca...trings
windows7-x64
3Payload/Ca...trings
windows10-2004-x64
3Payload/Ca....dylib
macos-10.15-amd64
1Payload/Ca...st.xml
windows7-x64
3Payload/Ca...st.xml
windows10-2004-x64
1Payload/Ca...trings
windows7-x64
3Payload/Ca...trings
windows10-2004-x64
3Payload/Ca...st.xml
windows7-x64
3Payload/Ca...st.xml
windows10-2004-x64
1Payload/Ca...trings
windows7-x64
3Payload/Ca...trings
windows10-2004-x64
3Payload/Ca...st.xml
windows7-x64
3Payload/Ca...st.xml
windows10-2004-x64
1Payload/Ca...trings
windows7-x64
3Payload/Ca...trings
windows10-2004-x64
3Payload/Ca...st.xml
windows7-x64
3Analysis
-
max time kernel
84s -
max time network
125s -
platform
macos-10.15_amd64 -
resource
macos-20241106-en -
resource tags
arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
22/12/2024, 19:30
Behavioral task
behavioral1
Sample
CapCut.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CapCut.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Payload/CapCut.app/LVWebView.bundle/LMWebViewAPI.js
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Payload/CapCut.app/LVWebView.bundle/LMWebViewAPI.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Payload/CapCut.app/LVWebView.bundle/LVWebShareInfo.js
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Payload/CapCut.app/LVWebView.bundle/LVWebShareInfo.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Payload/CapCut.app/LynxResources.bundle/lepus_bridge.js
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Payload/CapCut.app/LynxResources.bundle/lepus_bridge.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Payload/CapCut.app/LynxResources.bundle/lynx_core.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Payload/CapCut.app/LynxResources.bundle/lynx_core.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Payload/CapCut.app/PAGAdSDK.bundle/omsdk-v1.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Payload/CapCut.app/PAGAdSDK.bundle/omsdk-v1.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Payload/CapCut.app/PlugIns/AppNotification.appex/AppNotification
Resource
macos-20241101-en
Behavioral task
behavioral14
Sample
Payload/CapCut.app/PlugIns/ShareExtension.appex/ShareExtension
Resource
macos-20241106-en
Behavioral task
behavioral15
Sample
Payload/CapCut.app/ko.lproj/InfoPlist.xml
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
Payload/CapCut.app/ko.lproj/InfoPlist.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Payload/CapCut.app/ko.lproj/LaunchScreen.strings
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Payload/CapCut.app/ko.lproj/LaunchScreen.strings
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Payload/CapCut.app/libsubstrate.dylib
Resource
macos-20241106-en
Behavioral task
behavioral20
Sample
Payload/CapCut.app/ms.lproj/InfoPlist.xml
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
Payload/CapCut.app/ms.lproj/InfoPlist.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
Payload/CapCut.app/ms.lproj/LaunchScreen.strings
Resource
win7-20241010-en
Behavioral task
behavioral23
Sample
Payload/CapCut.app/ms.lproj/LaunchScreen.strings
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
Payload/CapCut.app/pl.lproj/InfoPlist.xml
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
Payload/CapCut.app/pl.lproj/InfoPlist.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
Payload/CapCut.app/pl.lproj/LaunchScreen.strings
Resource
win7-20241023-en
Behavioral task
behavioral27
Sample
Payload/CapCut.app/pl.lproj/LaunchScreen.strings
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
Payload/CapCut.app/pt-BR.lproj/InfoPlist.xml
Resource
win7-20240708-en
Behavioral task
behavioral29
Sample
Payload/CapCut.app/pt-BR.lproj/InfoPlist.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
Payload/CapCut.app/pt-BR.lproj/LaunchScreen.strings
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
Payload/CapCut.app/pt-BR.lproj/LaunchScreen.strings
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
Payload/CapCut.app/ru.lproj/InfoPlist.xml
Resource
win7-20240903-en
General
-
Target
Payload/CapCut.app/PlugIns/ShareExtension.appex/ShareExtension
-
Size
171KB
-
MD5
366d1dd0398fe8b93263a1c5de7552b5
-
SHA1
45a541d93f1667b154d24f8f110b849b29ceb840
-
SHA256
1c4d989771b7c4a5feeed016539d3d8a49e7b0d421f15c17954f49ae8d99fdf4
-
SHA512
33b428a656e93e03f486dbb129318edd114ba30825cf16c55f05366c2dfb0779f9c941231e0935f0684cf30da72d70e90d534aafbe414a0faa01808af0f9b9cc
-
SSDEEP
1536:pMhcxyUigUq9V7pzROEowIgs0CNoi0kldCI4zWyLDiELXSPyFJJUtDJiWJ8XJk+:p/pP7Zx4eh3wEZk7Z/OENpsRCNbZs
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Payload/CapCut.app/PlugIns/ShareExtension.appex/ShareExtension\""1⤵PID:488
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Payload/CapCut.app/PlugIns/ShareExtension.appex/ShareExtension\""1⤵PID:488
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Payload/CapCut.app/PlugIns/ShareExtension.appex/ShareExtension1⤵PID:488
-
/bin/zsh/bin/zsh -c /Users/run/Payload/CapCut.app/PlugIns/ShareExtension.appex/ShareExtension2⤵PID:489
-
-
/Users/run/Payload/CapCut.app/PlugIns/ShareExtension.appex/ShareExtension/Users/run/Payload/CapCut.app/PlugIns/ShareExtension.appex/ShareExtension2⤵PID:489
-