09ee851f3ee7daabffbf26e43ebb2c2fed3240502b161b71cc1a8ee76108e0b1

Sharing

Copy URL Twitter E-mail

General

Target
oc4vm-2.5.1.zip
Size 236.3MB
Sample260426-srtpcsc12p
SHA256 09ee851f3ee7daabffbf26e43ebb2c2fed3240502b161b71cc1a8ee76108e0b1
MD5 28367a51f86953cce92e95154d39f009
SHA1 ebbee9be5a9f91ddff7d542e669c6b516967e384
SHA512 1c52c774a2b07dc201895afe8d7b68a5b712461925533c74e6e0d20cc9a01f7a5df4fd293adb68447a40b23fc34fd4148f25cc9eea17707adce1c409ce2f38a8
SSDEEP 6291456:YTkpGKSpG1BpGcv+apGQXpGoypGF4ZZGvNasnK+pGczpGFb:YwpG3pGHpGGdpG4pGhpGyAPK+pGSpGB
TLSH
T1ECC833E9D6F5E925F32BA93FB80A0611DFF21002E60419F0057885E62777D6B9B1CF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  packages/VoodooHDA-Tahoe.pkg
- Size 881KB
- SHA256 bee6478162bf61533715227652453ce27a603f371dd1f96bdd0574f6fed20f15
- MD5 654529eb9cd94daeaa7ab0cac899e6b8
- SHA1 b68273d2833f4d779bedecdabb8d00433a75e58c
- SHA512 c771d13c8798658b3943eed9f80667a3e9e18e467b04dcaea314d0d5d2ad42d03754d2d258f13f8b0089028aefd527d8cd6b8084b47fe2d8e19c9a282406ffc6
- SSDEEP 12288:aYopZE7kGCe07WE3J1wbAhKj4dK2BPHHy3ZWLjB9dQ8v54RYm5RBsyfiXCgqT50o:aYL87RgAEM1PypWvveRY1yqXC3T51
- TLSH
  T1C7152321D6C361912837B3B9DFCA0A4926DF092E37861276AF467CDFA53021E7D77A04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution persistence
- Path Permission
  Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
  defense_evasion
- File Permission
  Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
  defense_evasion
- Installer Packages
  Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system.
  persistence
- File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
  defense_evasion
behavioral1
- Target
  tools/guest/cpuid
- Size 295KB
- SHA256 016445327d317b092e233ff3f8145b19be6d1db5ef11396d67386cb2be8fd94a
- MD5 c125d230ac3420bee2617e965af66e73
- SHA1 6a35fdb67971a347da0a286abeaa119af20a30c4
- SHA512 c1fbbf1a57aa8d9b3d73ce7591e692e3b785bc054cebf6693a88435aad21a80e46d6f64c8a047e0b514b4682355c97696b6cf0ebff64c3804c3c139756b4d0fe
- SSDEEP 6144:Pm0TkI3haWE17DaC6DNboQASs8j5ag4h+UHeLuOHvHBLsgs5hypjYRz1b6xxU3ve:+0TknjCrU
- TLSH
  T1BA54192BE3516969C32A8770034F576DE372D5A00BA30B733EA8A5B71DB26401FD3E65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  tools/guest/macserial
- Size 1.0MB
- SHA256 583694a8801061eca04aaa4fcc94803e994e6b193db6e9daa4716577b9e6083f
- MD5 ad54796628da2ad25528a74690e16252
- SHA1 1f62d9a9bc8a1564804cb0c5b1f20f87ed90bd79
- SHA512 0568af7d357f14fa11c0c5564ad7b0b32759712398f512f490bfb35b47c08cca206bf6613cde58ebae73b7041348e8156e16145bb673db9b6b688f5fe31dc93e
- SSDEEP 12288:YZSzi+e5MtntTdmfE4NRbzDzi+e5Mtnv41WcyVUDRy:YOiBAtT4fECRXXiBAv2W7sRy
- TLSH
  T14825BFEF0F525165C8080EB52AC8CBED6774F2BA7996A3166914A7F00D70C523D2BE4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  tools/guest/shrinkdisk
- Size 847B
- SHA256 1579cd9e1b47482c1e6b2b0006fd774527a7cf84ca08f795e121cf9ca51cb45c
- MD5 e03c2be92de37351b76366e65cfdb37f
- SHA1 be41d06ee90ac6ce9f4558b1a97b65783de32d3f
- SHA512 b8b675f39cb8bcd864ddbceea2103840c8ea936c2b6ea65a7fd996b605e08620ecf0175ee8469880a605e9d278def50b06f6c3f3a6ba8090734af17e56c35c0c
- TLSH
  T11601234379FD2CDC4DCE399568DDE522EDE6246A024937002485491EC0FC088DDED4E1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4 behavioral5 behavioral6 behavioral7
- Target
  tools/guest/sysinfo
- Size 303B
- SHA256 71dd34443e76fc287e2c41e8a4bbe3a7e6a7b9a1f347e75f8dcfeadf6b9281c3
- MD5 d51efe3b923ac531daa4543846362d2e
- SHA1 c0cb322b670b35b811d7c031c0f2a98112f1df3f
- SHA512 b5cbbccd8c1ef7045177d97996b2166fd11999ad1f6f6e126bb852c7ce10617a36beafffb1608ab235f449edea61051772422d992f6095990accaa3ee18cb3c6
- TLSH
  T17CE07D91BA5754D50BD657D6DDDDD411C53E1117904AB59638549C0D503061912CC4E1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral11 behavioral8 behavioral9
- Target
  tools/linux/cpuid
- Size 203KB
- SHA256 6342b1012ad553c83e243cecd23336ba7a3ab70d92d7270f6bb3edf72733950a
- MD5 683497d9a4e01523db16a8f7a85c2aed
- SHA1 ed83e0df87306baa993dff93b5a38e3fc80318c7
- SHA512 cac131d1a8d2a37a2fcbf0ea1679a6d529db8be294dd7fa0f3082f909ce8de9012d172e21319f435487fb3ade0caf6b9a3d1c963970f54c869d2ed1081105c05
- SSDEEP 3072:T+kT48W8saWblJ3GR8+57XebFSy952Bsc9IubuoXBSB8SiACjfbwfBWGfl2HksVW:Rs8W9aw7EWsMECjCj5s5
- TLSH
  T15A145B4AFB508E6BCE954B3685E70730A735E1426B83DB1B1F0D91683D833C8AF5B648
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  tools/linux/macguest.sh
- Size 7KB
- SHA256 c27c849140755744d1d79b184dfce02f4becf71c197749b18a7ac6e6b4d7d6cc
- MD5 2be8d114e52d51b7e19fd5fa64e744a0
- SHA1 55377d888460af137ced43815b8e076ab64b329b
- SHA512 6cd9537435ebe527dc9251f31e3dba3ed0d3307ddda7924d15ef2bfc6d705d731794ccb2d539f4b34b412c803a65fa46eef02243a1dfcb2e13ebda4dcc3d7699
- SSDEEP 192:8t57RXHsVCnYD9gmnaCOrHCnUOq7Y6b2LkPx:+E0nmFO8UOqsoPx
- TLSH
  T185F1D13A76C158F1500DD5ADD8C3A46E361C0A0B28082D69741EF9AC3F3D79DD1EA2BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  tools/linux/macrecovery
- Size 8.7MB
- SHA256 1a58ab7a6747cac4af74508e78fbb3671a208f4404b1169758645333d088ad95
- MD5 4831fdabf8951c9eda5d3e2d0407ce4d
- SHA1 136898eb37333efe3e81de96d89aaabe6aaf32bd
- SHA512 6861bacd7bec772c6c9141ddbe96ad1421155f69bd67bafdca112d92b03aed1b34861ba62c8bdde19e7fb449f28b38be748af69f5d8797824c50df5c5878c16e
- SSDEEP 98304:OqrZK5HVNB8MYbIQ1qEpIFsry8HwVm2WvENhA/KMa:OqiNybT13iPOwVl2ENDL
- TLSH
  T1D4968C13ED5429E5C1ED923289B3A252BB717C891B3163D32B90F6383F76BD469B9700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17
- Target
  tools/linux/macserial
- Size 485KB
- SHA256 3aaf4e64bad2d8cebdf545235b7eba93e28764cc61e49249c850494a6ccad8dc
- MD5 7c2387880eb0884ab892fdce8d3ba2a3
- SHA1 e6247767d4c207ad44c9ef4df54038afef2d9c98
- SHA512 014356e420d84c6eee86432a17515c004f175d77a34a1fc62469a5e193a3ce161c56fc9a851b07012858ade44b07887d587f2cd5ffbc0bedf7bc595b24b70c42
- SSDEEP 6144:e0HRMYAoHrPeCQ/WnsN9IF14DqtDv+6azYW+n8qzhboCOAfa8wgL/GS:emRMYPyCQPR
- TLSH
  T144B47B07FAD74EFEE120DE761CD020A1867BF4793B2153133558D32A329D8626E37A98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  tools/linux/recoveryOS
- Size 2.8MB
- SHA256 6bb8224630aae2c3ed5330bb29efcf1196a090a0e58e7fe9124b53542a3e52f8
- MD5 5e4aa814d65ccc4acb95aba79534d135
- SHA1 fdbbd8b548b25b9658ff2d3031a7a2a99fa163a0
- SHA512 2f9a8db4644b194ef28e8619fb7924fd12ef176bf197970af80f4d71af709918e84fc5927a8335b03c4daf03471153d680d0a37bd29ffd388281dddd1476f617
- SSDEEP 49152:gMxIy2sZO/WD/v4ak3OLmfq/JFDNL7nSh8f9ZigXXl3AvO:gMeoZEUNa8wW
- TLSH
  T1F9D59D177CE018A5C0AE92328AB355967B71BC490F3163EB3E90B67C2F72BD46979704
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  tools/linux/vmxtool
- Size 2.3MB
- SHA256 dd79dac4a27e424da46b4dc7c98cc1df28379bfc725943a3e8c3fc11622fa08f
- MD5 4a13420365fcef9e767d00d799111374
- SHA1 90cf0f3c845e6cd39aab3f95565cc4c2db78f904
- SHA512 367a40bbd9f035d9821ae683c93cc4a9b4925f2251fdf8408fe43dd230fef1711b38ee654b5f31a855742f944ee3e08cec89240d3c8c928a574e09269eb3fdac
- SSDEEP 49152:0jBA4+LkQiLWKctJxdPawDtf9DthfNVlMRiq/:0jOHoEKCh3Bdlrs
- TLSH
  T17DB58D47BCD018AAC0EA92324AA751A1BB71FC4A0F6163C73E50B7782F76BD45D3A744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral20
- Target
  tools/macos/cpuid
- Size 295KB
- SHA256 016445327d317b092e233ff3f8145b19be6d1db5ef11396d67386cb2be8fd94a
- MD5 c125d230ac3420bee2617e965af66e73
- SHA1 6a35fdb67971a347da0a286abeaa119af20a30c4
- SHA512 c1fbbf1a57aa8d9b3d73ce7591e692e3b785bc054cebf6693a88435aad21a80e46d6f64c8a047e0b514b4682355c97696b6cf0ebff64c3804c3c139756b4d0fe
- SSDEEP 6144:Pm0TkI3haWE17DaC6DNboQASs8j5ag4h+UHeLuOHvHBLsgs5hypjYRz1b6xxU3ve:+0TknjCrU
- TLSH
  T1BA54192BE3516969C32A8770034F576DE372D5A00BA30B733EA8A5B71DB26401FD3E65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  tools/macos/macguest.sh
- Size 7KB
- SHA256 c27c849140755744d1d79b184dfce02f4becf71c197749b18a7ac6e6b4d7d6cc
- MD5 2be8d114e52d51b7e19fd5fa64e744a0
- SHA1 55377d888460af137ced43815b8e076ab64b329b
- SHA512 6cd9537435ebe527dc9251f31e3dba3ed0d3307ddda7924d15ef2bfc6d705d731794ccb2d539f4b34b412c803a65fa46eef02243a1dfcb2e13ebda4dcc3d7699
- SSDEEP 192:8t57RXHsVCnYD9gmnaCOrHCnUOq7Y6b2LkPx:+E0nmFO8UOqsoPx
- TLSH
  T185F1D13A76C158F1500DD5ADD8C3A46E361C0A0B28082D69741EF9AC3F3D79DD1EA2BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23 behavioral24 behavioral25
- Target
  tools/macos/macrecovery
- Size 8.9MB
- SHA256 1e6334c366dedd2202875b522a6c1939350669b94964d40f744ce79f0d59a534
- MD5 9b2fca6f344a328f72d6c771695b6da9
- SHA1 edb7184e7f9e3d073184850b7957b844854ef64a
- SHA512 1dafae282057fbbf7d9742ee6e1e6f8919a7c938c0260b079ddfc62247e855266cdc03309af564499090f7b31df97fb7ef83fb22d5f8db4998f6fd9be84b61a9
- SSDEEP 98304:dPQqZGKkRGP+Ll8gtmEALSAqWlwHK4MhjKC4OTgmWjWPEEq1f6:dxI6AftISXWlwHKvBKRA5Wj9E
- TLSH
  T18396AE23EC9415A9C1EDE23189B2A153BB71BC491B2137D32B90F6346F73BD0A9B9750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  tools/macos/macserial
- Size 983KB
- SHA256 c920802bbba68bdcf3da7e1db3c45a1e0756b5a653c869db9ff8142272c57231
- MD5 655e4d0c724802b1ce52e7ca9ccb9cb5
- SHA1 71aa924a6543c339511c55aaff7bbfc83e33baee
- SHA512 fe2051f8928360a4c5fb063853375199f582a176a4230161df2a0518c3a5fe5dc416f3602cbdbdfbb43c35659751959eae4723e0b7a330b599650f0ac8c3a011
- SSDEEP 12288:ghzi+e5MtnUkSPbsWzi+e5Mtnsv9x4R9Hh:gtiBA6TLiBAsv9x4R9B
- TLSH
  T1F625BFBB074B02FDE0004EB7684857A85B64FDE67921A353B9128B651E74CD3BE26F43
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  tools/macos/recoveryOS
- Size 2.7MB
- SHA256 2e2d74aa9bd217905ea5e70866033498ede1725f19f3f3415333b379ecbc3233
- MD5 5ee743f7be31e31b3f34b1ae2613379e
- SHA1 005f9f400f423c74626fc39a197f36cb25bbe953
- SHA512 87e40295ea984b0b6979e535196ea8a9fd84f3e640ea35543df5d77c458edc520029b5d5d0ca369f564eda5e08cb3b77c3e4117956fee784db846fcfd277832e
- SSDEEP 49152:bYVHvJvZEy0bZE0cbNLbcd+3JtruSdnnvIBkg1Ff0J0LIfI:bYVlZDbcjSdnnvSfDkfI
- TLSH
  T1F6D59E07BCE045A6C0AA9636897751D67F31FC8A0F2127C72E50B6B83FB27E06879754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  tools/macos/vmxtool
- Size 2.4MB
- SHA256 deb15fd2e5eb8933592c08eaa8055ecc1589cdee07388996d5127e77e2278e5d
- MD5 a298f51131f7692c86fa5dcdc2821808
- SHA1 89e00bf50e8505f99ff4905c1f72389dbce9d7dc
- SHA512 7f78ab833fe65722c2907f0aaa62180b5fc14886d077871ee6d1dd46967572e0ecc08be0873a2a7bcd1912ba96891611966a4959dbaec751719a5b6e1b09033b
- SSDEEP 49152:GzazkPGxShm8g81hS2mH8Ry0IJSzr849Kxprx//dcaf2PeThBf2U:GzaIOkk5FXx0I2Qrp1cyLTrf2U
- TLSH
  T102C57C07BC9048A5E0AA92368CB69291BB32FC490F3127D73E54F7782FB6BD06975744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  tools/windows/cpuid.exe
- Size 220KB
- SHA256 51dc322f691f097bfc3991d1da21201a7265cb20101046837f775de0b942f97b
- MD5 2e65d490da3212309181fd2dd779a20a
- SHA1 77c2beb1fa3ebcb0c8bbfb3e93759414a5f8483a
- SHA512 083467c2c4129105299d6b3cbeefa48c81581c1cee8f5428ec874702ec11e7d3e7803cfb2603fe95df1d7e32284b00cbe76b49c71ddf250b0303938eacd35a67
- SSDEEP 3072:Aqb663l9qVfN0bl4AV2tPMgkOD65FbNrR4VkT48Dadazmxyk4:AqmSqVgl4dtPtkKIBbs8DYazV
- TLSH
  T11F246B0773A16EF9C863C13A128BAA117633EC940720D2F316952A7D6D37BD21EB7179
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  tools/windows/macguest.exe
- Size 38KB
- SHA256 949642c2f2a45d0a0a8fcb24643027c2fe664e9048615f8e8115338b1f0a09db
- MD5 621505f372b9b4b6620a6fe0d882cb2f
- SHA1 9c70e25c60d9ab3cc3d01a9877549a03617244c8
- SHA512 7be959c5b56f17adf33dc8ae6a83f057b000a1e8b088d084bc0c6ef47a1fafab6b6a2ff1e173d7d9b2cd601007662a34aee362d7ce9b6ea3bf26ace38e9e1339
- SSDEEP 768:XmGZMXd+HD0LO3C1QDNTpi/+EKMtdYt2ty6XbYC10kLoSQ:Xu+H0T2DNTpi2qtdNjb/Lob
- TLSH
  T11B035C69674CC26AD65F0E7CBDA3491509B083122602DBDD3ECDA4EEDF9B34486213DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Path Permission

File Permission

Installer Packages

File Deletion

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32