8e09d495f909ca450b56359d60bc5e2136fd589655222a0a8c13ff1031d874c5

General

Target
Biramo
Size 674KB
Sample260511-g17rssb19z
SHA256 8e09d495f909ca450b56359d60bc5e2136fd589655222a0a8c13ff1031d874c5
MD5 68137afe4951ba348f232515e816d3e0
SHA1 e40013e790ddba2714c61911460f94b33c146243
SHA512 6a03f77c319a62d4d77e6715928707331140b815a76fa92b4bb7a2786c386b4d1aae236ae4307b86f909f348a7bd690c33a82494e1f8330221349b19f5c35316
SSDEEP 12288:yNu1BvrYIYJz0cNxfpqj69r/O86HCRFytSOhvgTLieKosdMAc:yNu1VlOKDtSOCmeKLdM
TLSH
T1BDE45B3B91B96485DC9B72BC7BC73A77BC10BA783370E1D55E03422C9DB1722962921B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Identifies hardware specifics through system_profiler 2 IoCs

ioc	Process
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"	Process not Found
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType	Process not Found

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"	Process not Found
osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Biramo\""
1⤵
PID:455

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Biramo\""
1⤵
PID:455

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Biramo
1⤵
PID:455
- /bin/zsh
  /bin/zsh -c /Users/run/Biramo
  2⤵
  PID:459
- /Users/run/Biramo
  /Users/run/Biramo
  2⤵
  PID:459

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:446

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:449

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:441

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:443

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:451

/bin/sh
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:461

/bin/bash
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:461
- /usr/bin/killall
  killall Terminal
  2⤵
  PID:462

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:463

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:463
- /usr/sbin/system_profiler
  system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
  2⤵
  PID:464

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:466

/bin/sh
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"
1⤵
PID:469

/bin/bash
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"
1⤵
PID:469
- /usr/bin/osascript
  osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"
  2⤵
  PID:470

/usr/sbin/kextcache
/usr/sbin/kextcache -F -system-prelinked-kernel
1⤵
PID:478

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:500

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:500

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 198
1⤵
PID:501

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:501