Overview
overview
10Static
static
3payment details.exe
windows10-2004-x64
10payment details.exe
windows11-21h2-x64
10$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3Arbejdspressets.app
macos-10.15-amd64
1Analysis
- max time kernel
89s - max time network
104s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
06/05/2026, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
payment details.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
payment details.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
Arbejdspressets.app
Resource
macos-20250619-en
General
- Target Arbejdspressets.app
- Size 70KB
- Sample260506-kclffady3s
- SHA256 707b45bf97996cee1b8576e939a2f68b5940a17f748736bb197448728fde5eae
- MD5 987679eb7ad256e662f3f5ce8ebcaaed
- SHA1 7e273676762f0851329432e7f6b6e992f450fe8b
- SHA512 8aa5750cddf90c43cab633a773eb2a9ad68091eb79161a966a77c5b32967cfc5633ed6afef9cbf5f111412d2ed7924301da7f414fa96a188375e86b1ba2a0caf
- SSDEEP 96:+QURIg7/4RftyGcsjKkyKG/FbAT4Ikw4TFQo:CIg7/kNcsjKkyKGAEb
- TLSH T1A9631AF47C98770BBE4F68D914164AB8DD3C99877CE01046F4758944A9C9FCD8472A13
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"open /Users/run/Arbejdspressets.app\""1⤵PID:473
-
/bin/bashsh -c "sudo /bin/zsh -c \"open /Users/run/Arbejdspressets.app\""1⤵PID:473
-
/usr/bin/sudosudo /bin/zsh -c "open /Users/run/Arbejdspressets.app"1⤵PID:473
-
/bin/zsh/bin/zsh -c "open /Users/run/Arbejdspressets.app"2⤵PID:474
-
-
/usr/bin/openopen /Users/run/Arbejdspressets.app2⤵PID:474
-