General
- Target 7316df3e25bffbbbd4772c61c6ba7a9fdf28f5e95ac7057558a7b9ea3c258b0d
- Size 15B
- Sample260509-wpsk3aew2l
- SHA256 88a2a33269c6699da8da7c736965b21a88f4b687d3f739d55258296322d21f15
Malware Config
Targets
-
- Target 7316df3e25bffbbbd4772c61c6ba7a9fdf28f5e95ac7057558a7b9ea3c258b0d
- Size 15B
- SHA256 88a2a33269c6699da8da7c736965b21a88f4b687d3f739d55258296322d21f15
Score8/10-
Keychain
Access macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.
-
Exfiltration Over Alternative Protocol
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
-
System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
-
File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.