8ae976c8b28baa222b4fd527cccbad2d1102ed21c68f9082c53835fde94c2397 | Triage

Sharing

General

Target

Hot Tub-2.1.2(19).ipa
Size

27.9MB
Sample

250328-qxvshaylz3
MD5

5670e6e1be3e1ce16216b1395e6a8a78
SHA1

b31c1ee45f3df10203b53da72bb7d12ee9388f30
SHA256

8ae976c8b28baa222b4fd527cccbad2d1102ed21c68f9082c53835fde94c2397
SHA512

15aa7eb819b1c0c7bd3c218189e4829be9c122d1b61125a9410001402bab969b8a368cb5ba7146fcc2115b60e817071f67b6a028151fa9d013689ab9394a338b
SSDEEP

786432:ZVWS5k6D+4mcxQXBYnhS2SKMSc9fgKnbcEFxLJTJR:XF5a4VQif7enHF91

Score

3^/10

discovery macos

Malware Config

Targets

- Target
  
  Hot Tub-2.1.2(19).ipa
- Size
  
  27.9MB
- MD5
  
  5670e6e1be3e1ce16216b1395e6a8a78
- SHA1
  
  b31c1ee45f3df10203b53da72bb7d12ee9388f30
- SHA256
  
  8ae976c8b28baa222b4fd527cccbad2d1102ed21c68f9082c53835fde94c2397
- SHA512
  
  15aa7eb819b1c0c7bd3c218189e4829be9c122d1b61125a9410001402bab969b8a368cb5ba7146fcc2115b60e817071f67b6a028151fa9d013689ab9394a338b
- SSDEEP
  
  786432:ZVWS5k6D+4mcxQXBYnhS2SKMSc9fgKnbcEFxLJTJR:XF5a4VQif7enHF91
Score

1^/10
behavioral1 behavioral2
- Target
  
  Payload/Hot Tub.app/[email protected]
- Size
  
  3KB
- MD5
  
  6afd105284e3ca1915c776fe9c61ecf5
- SHA1
  
  f5200b40b6f0e37bc1b2d57daafabf468d9be207
- SHA256
  
  22d81d7bf425dc368de37517338489fc100d84896267c75caf35911735e8d201
- SHA512
  
  85b5bc92887d31ce0a111eb2515ca8bbc671c86d246b53d530cafd3e824f5ca4acdb99e5b08a080f3c4c8341686e29d0914d5ba88709cd43e2acb7542e417fc4
Score

1^/10
behavioral3 behavioral4
- Target
  
  Payload/Hot Tub.app/AppIcon76x76@2x~ipad.png
- Size
  
  4KB
- MD5
  
  eab67d9ec28338470e6781795b7b0510
- SHA1
  
  082435f4af985cf1d2df28da7026d5ac44bde501
- SHA256
  
  b25229448c1e5abfdc549b26be69a4a99d587caa7cee1d624a9ff84b62ba1ed9
- SHA512
  
  beead88052c625f0c7efbd10519db11a2ebf74712376486d4f4f20cd5b52bbbd2aa3e2f3ab6a24a40935e8d097cde74930f09d9cb8a743b64e48152537d6948e
- SSDEEP
  
  96:q0nxEKgeRm8MvFrqyH6iY9vOIvQW5wJRn1S4MBtNT9fZ4f:quEK5+daRt+/fMBb6
Score

1^/10
behavioral5 behavioral6
- Target
  
  Payload/Hot Tub.app/Assets.car
- Size
  
  5.5MB
- MD5
  
  b486f3f3894271a631b25fcb17e8c810
- SHA1
  
  12caa0bcf6f635fd8f4563281ab11270ec11cd20
- SHA256
  
  6d08ee3dd404f782e4abe22ef31225d7b70f8b6d5170b0438655dd35e5d3f9ab
- SHA512
  
  343c013e3f9d5ac0ce3c14684e881381b40708f51552b1ac5a6bec0f722b66062ff5bd4ae0c55edfd62d2e3961c15e5601cee8f3c14543b27f2f68f6b17aaeee
- SSDEEP
  
  98304:b6CIZ0aZ2/ItAHbp7NwOgyAkvqXrphDdaWkvqMrpgOgyyDdaa:W+HkGp5UyMX9JM2y+n
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseCore.bundle/Info.plist
- Size
  
  697B
- MD5
  
  ca83e596bc0a57a1adbbafeda4988432
- SHA1
  
  c239f264cdb2df4cfeda4c11eaa3e799f6a4373c
- SHA256
  
  97b41ab7aaaae9b15bc19c69d513bdb8797b73d860991d2616fe01b7eb6373d3
- SHA512
  
  aeb610cf3e8ae1a89a0355404fe1fcc90f2f2a298b50786b6f72d6c4bad1ade8fc28629066c2f3d6eeefa2229e6b5b569fb34aa912d32b06b9b739d055012c61
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseCore.bundle/PrivacyInfo.xcprivacy
- Size
  
  855B
- MD5
  
  01481a78735eb6813ce4f5d85d4230ff
- SHA1
  
  b1ad8e84596a742232cfda15edf51d0ca5b314bd
- SHA256
  
  11e31f5f6b60e80ebd5901549fce5043f9af3e683f874022945000b405306c3f
- SHA512
  
  9df8c09641f2183703db320e69b6b6b4b0118e695ba42c58026556b7a99f67d1c4b1bc1992fd9fbc03cc67665e6ec56aa3d23780209b1e082ad656f6f3d7989f
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseCoreExtension.bundle/Info.plist
- Size
  
  715B
- MD5
  
  fe24c35d944a211114ec155e1b03df3b
- SHA1
  
  9b80d4698660c192cc98dfc7cd05051240d59a25
- SHA256
  
  d8c3df28e5f49659b72ecd4de57da4e9f7aae77e07acc4337f9e50f7f1e284e0
- SHA512
  
  a13315d5cf25a3c7d1007f0bd1d4f18b51bc15780c1a821ec85bb100be44ef62bff2f59a8495531e771cceb3e3b72b1b009b6ff591083f2e62cc063026e4e887
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseCoreExtension.bundle/PrivacyInfo.xcprivacy
- Size
  
  478B
- MD5
  
  bb9f4bab20013bcc198a617873aaeca5
- SHA1
  
  ea20654845b3ac3eb3a2e1f1e0da9e0e18ca4864
- SHA256
  
  1377eccedff8f8320f78040e9c9d3e17ecc0ea569594b56af0ef17be44197c7a
- SHA512
  
  e162daa56a0ea3f32f8c1ed2e37c319820882c108401feff6579cc43d077844c45e67b99b17b2f51894dff1a97c11c87c6f088e0fac2007f408bfcfd59154b0a
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseCoreInternal.bundle/Info.plist
- Size
  
  713B
- MD5
  
  f7ecc481928121fabe54a0c71143d1e0
- SHA1
  
  1897c265f46060e69b1062b5539a3a687156beac
- SHA256
  
  b1501fd58a0ceefe4bcc7a3eb317ead13b634594ae62755ae6845e1ed5babf7f
- SHA512
  
  c72e7a7d2d11b1260f51875b88337a3f4aabd6398c65fe42104c82bc608cee4d1a56b71edac99e5c40f7b1bcd75780409a9350d33d799a36f597a2093373af97
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseCoreInternal.bundle/PrivacyInfo.xcprivacy
- Size
  
  855B
- MD5
  
  d9a1434ea74d42663991df3301fc37f4
- SHA1
  
  89fa1386ba9b6eaa0b1b8ca302bb8c41169fd03c
- SHA256
  
  5b7fe979423dede3e08afc29a42f00f6086275dc548a84c29774235863eed3ef
- SHA512
  
  bcd074775f37cb216fd41bb106f74a6be8bda5cff91af9481f222e431c23099225f370bdcc73f990434fecb816b36bbb90148e97a37b878f05ea37cd06cf27e5
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseCrashlytics.bundle/Info.plist
- Size
  
  711B
- MD5
  
  144187eea220a66e7ec5fa4b7d0a16d7
- SHA1
  
  d9c74e5fd677a85a07083de9c514abdf8323053d
- SHA256
  
  f165fb8c2601999d32ad1b350c6d3d854523b11be172c9234e1707313a1e9e40
- SHA512
  
  d2c914464c131f63f6ea2bfbea18f8ebe8904a19f9688d616dd199fbb03cce3dffb9495e53e976cf12951180a94139cfec54babb939c97e96e7092fa69772596
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseCrashlytics.bundle/PrivacyInfo.xcprivacy
- Size
  
  1KB
- MD5
  
  1fa581c145e442358018443c23c0b2ba
- SHA1
  
  8377dcdf2eb7e90242a0f888be97d7cb07a5b810
- SHA256
  
  e9bcc6e9c7382bf506cadabe74cfd4ed155686806ba81c195a634b86aa5fcce0
- SHA512
  
  8b4a37d121f728a6608dff0582c6c6b28ad8d18fedbc35d0f6c920f59fdb650eaa66e79d51172bc6ea82e18d88bcbfdb60f373a892c3e2eb3504340e65dfc50c
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseInstallations.bundle/Info.plist
- Size
  
  715B
- MD5
  
  90515c715ea62f2cbd0a01e2ba24f814
- SHA1
  
  2566b8c8892f496b715f39a5981a5778ec6de83a
- SHA256
  
  9156b0a707f4ec27136b46df05a4ed029a6b1e8480e8af45f38a86972a3aae1a
- SHA512
  
  1e58bb7bd7fa897ef8289cc0cf39f2f92c127c5fde041f3c21f17d52d6dc6ba8b25e9d5bc069c333445f3ed3e87e971aa398a1c95773c48c1ad4d8508707b8ff
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  
  Payload/Hot Tub.app/Firebase_FirebaseInstallations.bundle/PrivacyInfo.xcprivacy
- Size
  
  1KB
- MD5
  
  909ec8a142f6427169254ceaadb3ba85
- SHA1
  
  59741426bef978c4608959cb1b27fc1abdee2d45
- SHA256
  
  cfbb3c4f76a66d53698bae91f7110c00f2148e6e6f13ad7d32592909bc010e51
- SHA512
  
  4fccee3177669409985a6822d9eeb36cff23333845396ed33cfbf88f4d862db597ec6a8843d7e82c29816c44c7f0926614e225a9416201b6c2413023b04b8466
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  Payload/Hot Tub.app/Frameworks/FirebaseAnalytics.framework/FirebaseAnalytics
- Size
  
  48KB
- MD5
  
  a6ace234b21f8dcd39baeeb770eb51db
- SHA1
  
  482e230a7dc454ea97023e79f63aad89eb725fa0
- SHA256
  
  4c9deca0ce7a2d17b42a9d441962ac643159318921c5e521226663dd3dc2debb
- SHA512
  
  59d49e094387704075b77355c2311cc60041dee08e7eb7b9af8fd7e98fcc8f4b6331cc9039e39bf6f9d7bab681ef725607762e974b28826c5c4234936dd8bc7f
- SSDEEP
  
  96:9xzojIcDrwCikDpJxFtG6wbWIud4OZE173gAholkz5w/byYKG9:XzoXzdJ9XJIx8P05prG
Score

1^/10
behavioral29
- Target
  
  Payload/Hot Tub.app/Frameworks/FirebaseAnalytics.framework/Info.plist
- Size
  
  1KB
- MD5
  
  c0e37bf9b1f98f7e19122ac3496fb5a8
- SHA1
  
  cbc2e0d83f38dc040841582e3c9b1dc985e23089
- SHA256
  
  5f5ce89bfaf647206d7f4dda9c4221c2aed170875e10f4d505b0acb99867e6d2
- SHA512
  
  432d155c60ce3f68b6c69ec89508dd00ffb3fd3a12bf8f65c9c57d26cdae74c3615df678e98bf35a75598e2614585a1609e832ff15fd4db8adc15621250853c6
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  
  Payload/Hot Tub.app/Frameworks/FirebaseAnalytics.framework/_CodeSignature/CodeResources
- Size
  
  1KB
- MD5
  
  2232132871718ef545c4f6627bb1eacc
- SHA1
  
  361def0e6ae801d1a3a17b5851d9ff7b5d6bea98
- SHA256
  
  546153da3a026675abf1ce50e6d6eda7bb2b0364301a0c4b43a283f7f99008d5
- SHA512
  
  954d0b93e8e48ecec6512f680e42670febe594259952392c43042347157cf966654ccc07f34086320605dd9268556b1126b2e21af2d30aeb79b8b60bc305f646
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32