dc1dc7dd4fc3093f7c73d7731f2d1481dc80005414cbd66f3dc7fc0e7176dfc4

General

Target
terminal-explorer-macos.dmg
Size 16.5MB
Sample260426-semqaacw9q
SHA256 dc1dc7dd4fc3093f7c73d7731f2d1481dc80005414cbd66f3dc7fc0e7176dfc4
MD5 13ade26e102159c9c96a8ffac603fe0b
SHA1 97502cef65bf745013a2b6f082fd25def0947aff
SHA512 547d1d8eb81b156159f294d5a1cd7b61588928948f80709a29087d81b1b6f6e7fb2603078395864cb08a3c22871fa656fefa3d8bc08c1b20d45ef9d13a8b6bf3
SSDEEP 393216:W9Ykm6N5G+po1TrtBMzu12kTBDM/gJ+0e4GBT/9TYOmyiWFkrXOiaYY:W9YkZ5DwZBMYGgJ+0TGBT1YO2WFc+ia7
TLSH
T142073338DD116A1BEE35E97057D0B2224D90F5F32933809DC197E3B29CA2B9B35D81D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
"/Volumes/Terminal Explorer/Terminal Explorer.app/Contents/Resources/terminal-explorer-macos"	Process not Found

Command and Scripting Interpreter 1 TTPs
Adversaries may abuse Unix shell commands and scripts for execution.
execution

Unix Shell
T1059.004

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Terminal\\ Explorer/Terminal\\ Explorer.app\""
1⤵
PID:523

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Terminal\\ Explorer/Terminal\\ Explorer.app\""
1⤵
PID:523

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Terminal\\ Explorer/Terminal\\ Explorer.app"
1⤵
PID:523
- /bin/zsh
  /bin/zsh -c "open /Volumes/Terminal\\ Explorer/Terminal\\ Explorer.app"
  2⤵
  PID:524
- /usr/bin/open
  open "/Volumes/Terminal Explorer/Terminal Explorer.app"
  2⤵
  PID:524

/usr/libexec/xpcproxy
xpcproxy com.jergensturdley.terminalexplorer.2332
1⤵
PID:525

/Volumes/Terminal Explorer/Terminal Explorer.app/Contents/MacOS/droplet
"/Volumes/Terminal Explorer/Terminal Explorer.app/Contents/MacOS/droplet"
1⤵
PID:525

/bin/sh
sh -c "/usr/bin/mktemp -t terminal-explorer-XXXXXX.command"
1⤵
PID:527

/bin/bash
sh -c "/usr/bin/mktemp -t terminal-explorer-XXXXXX.command"
1⤵
PID:527

/usr/bin/mktemp
/usr/bin/mktemp -t terminal-explorer-XXXXXX.command
1⤵
PID:527

/bin/sh
sh -c "/bin/chmod +x '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/terminal-explorer-XXXXXX.command.9oQBCCL4'"
1⤵
PID:528

/bin/bash
sh -c "/bin/chmod +x '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/terminal-explorer-XXXXXX.command.9oQBCCL4'"
1⤵
PID:528

/bin/chmod
/bin/chmod +x /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/terminal-explorer-XXXXXX.command.9oQBCCL4
1⤵
PID:528

/bin/sh
sh -c "/usr/bin/open -a Terminal '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/terminal-explorer-XXXXXX.command.9oQBCCL4'"
1⤵
PID:529

/bin/bash
sh -c "/usr/bin/open -a Terminal '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/terminal-explorer-XXXXXX.command.9oQBCCL4'"
1⤵
PID:529

/usr/bin/open
/usr/bin/open -a Terminal /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/terminal-explorer-XXXXXX.command.9oQBCCL4
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:530

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:530
- /usr/bin/login
  login -pf run
  2⤵
  PID:532
- - /bin/zsh
    -zsh
    3⤵
    PID:534
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:535
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:536
- /usr/bin/login
  login -pf run
  2⤵
  PID:537
- - /bin/zsh
    -zsh
    3⤵
    PID:538
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:539
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:540
  - - /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/terminal-explorer-XXXXXX.command.9oQBCCL4
      /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/terminal-explorer-XXXXXX.command.9oQBCCL4
      4⤵
      PID:541
    - - /usr/bin/clear
        
        clear
        5⤵
        
        PID:542
  - - /Volumes/Terminal Explorer/Terminal Explorer.app/Contents/Resources/terminal-explorer-macos
      "/Volumes/Terminal Explorer/Terminal Explorer.app/Contents/Resources/terminal-explorer-macos"
      4⤵
      PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:533

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:546

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 186
1⤵
PID:547

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:547

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:551

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:554

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:554