b850cd121b76d1b1610a05fde0c7a11e3169f545617a5a5b0e7c440bd7b30944

Analysis

max time kernel
90s
max time network
185s
platform
macos-10.15_amd64
resource
macos-20241101-en
resource tags

arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
17/02/2025, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Macos-Malware-Samples-main/11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096
Size

794KB
MD5

a61b7219a266d71d2526885e53fdef03
SHA1

a19807571acbca1898d72ae1a893a385351b0b80
SHA256

11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096
SHA512

9455cc98506348923fa67444d0131970d88f294b94b9290a223727e7e632e053ae35152f7dd85e95b14da59d9aeb560e1150004e5a5f38793c92d69988ededf3
SSDEEP

12288:Ikpo5drTv7z7tztzQZ43zwG0okb23HXRTcnfLIsxX2qd35G40RMoxV:kdrTDz7nQZG0bokbeHBT6MsxGiJG40RP

Score

7^/10

discovery

Malware Config

Signatures

Queries the macOS version information. 1 TTPs 4 IoCs

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

discovery

System Information Discovery

T1082

ioc	Process
sh -c "/usr/bin/sw_vers -productVersion"	Process not Found
/usr/bin/sw_vers -productVersion	Process not Found
sh -c "/usr/bin/sw_vers -productVersion"	Process not Found
/usr/bin/sw_vers -productVersion	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096\""
1⤵
PID:490

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096\""
1⤵
PID:490

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Macos-Malware-Samples-main/11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096
1⤵
PID:490
- /bin/zsh
  /bin/zsh -c /Users/run/Macos-Malware-Samples-main/11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096
  2⤵
  PID:491
- /Users/run/Macos-Malware-Samples-main/11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096
  /Users/run/Macos-Malware-Samples-main/11ddbb40f941cb946b7865e3e8b67dd97fe401f26f441e943fc916970c53d096
  2⤵
  PID:491

/bin/sh
sh -c "/usr/bin/sw_vers -productVersion"
1⤵
PID:492

/bin/bash
sh -c "/usr/bin/sw_vers -productVersion"
1⤵
PID:492

/usr/bin/sw_vers
/usr/bin/sw_vers -productVersion
1⤵
PID:492

/bin/sh
sh -c "/usr/bin/sw_vers -productVersion"
1⤵
PID:494

/bin/bash
sh -c "/usr/bin/sw_vers -productVersion"
1⤵
PID:494

/usr/bin/sw_vers
/usr/bin/sw_vers -productVersion
1⤵
PID:494

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads