3ba71547b865ef02758e6cc8a27c2d9917c9b315a38cf68115038acf89c295fb

General

Target
macOSx_Downloader.zip
Size 2KB
Sample260602-g3rhlaez2w
SHA256 3ba71547b865ef02758e6cc8a27c2d9917c9b315a38cf68115038acf89c295fb
MD5 e8e8c7ebeb982596a72ede5cbfc2a6d9
SHA1 38bcc24ec2b2e0ddbb9ad73ddd50b960b1deec52
SHA512 4d1132d67bf1d03b943d1b226c66e0e9a752806a5e8ea2b23f95852a406ac6d6828a2b9be19ed3d3e8bcb5db0f2766b17ced9c16d775d120c68f39dbe4a1aa97
TLSH
T148513C3DA2D9ED14D8DF85707BC75E49C72862D88D94AA4B78A8B602C9143FE1740501
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
https://raw.githubusercontent.com/tiiisiet65-sudo/yheyue/refs/heads/main/macOSx.zip.b64.part1
exe.dropper
https://raw.githubusercontent.com/tiiisiet65-sudo/yheyue/refs/heads/main/macOSx.zip.b64.part2

Targets

- Target
  Chay-Tai-macOSx.cmd
- Size 838B
- SHA256 5068872e9de0a0c39794379e61cee5472a4b9402f78be4f1a31dd243dae7d6b5
- MD5 8eee917f48574cfb95aeaee904478c81
- SHA1 538e049b4a58c3b50207c16bb18baf1f6fe0aab5
- SHA512 24e3d3ff2dd872d7539b76ddc5f15c27621d25d10590671c48a8e418b0847e7feaa26ed4879ede7670bd1d9a7e0582d6ec0d91897829e2cd01329d0fbde9bdc3
- TLSH
  T102011210B48F445805FF9C982328010DE613904F93159EAEB063ECAC2B282DEC3F5CED
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Tai-macOSx-tu-GitHub.lnk
- Size 1KB
- SHA256 43c396cbab10d5d81d0a94257bd39acfa1b3cc667554285df1f96488d001a1ca
- MD5 66f2d087db9e414102dab35e27c3ce50
- SHA1 0cbd4fa99ae181447ee518343cc35626ab14dc42
- SHA512 44eb5b3c0a24ae1c8629e460cab7c03d2dc6404bd4c0f955c3f09cf179c865b41f6e1f032a4ecd7135648f63c526ceb99aeafca8b7b3e6b742470f4629df463b
- TLSH
  T19221762026FB0304E7F35A39A8B1D220AA737855ED27EBCE0280150A4C2655ACC76B1B
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  Tai.macOSx.vbs
- Size 507B
- SHA256 18cc8da882a1a9591688713db6b72feb2bcada5916113a70caec1aacc7f75f84
- MD5 ee0f47bf9c0d5c451fd6ab7b08e74723
- SHA1 9e3292e8436b5283771b33c37faec2f9c2e35c2a
- SHA512 f0f85860a5e868843fc5afff46755d5276b3378c99e50c24931c606f225670b6f6119bed42965ebecf0adea398221bd6d12d0fb48393b7d5e38a7359bb04771a
- TLSH
  T18BF09E09E95FC5784823D59273EF9C5EDB3070995924F1ED19A4C8C884243BD4B554CB
- MD5 SHA1 SHA512 TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  restore-macOSx-from-github.ps1
- Size 2KB
- SHA256 ee3cd3e68bd7422e4ed5058689b86bec66e13628e9fe79c13240b8992f4f1daa
- MD5 f84e7d00575a5ff8d832aa73fe9b3bba
- SHA1 207f2375da14047e7ec3c7c4ae979810764d8709
- SHA512 05456539d0a3807bedb830d92a3b57cabc3c74d668eb0abadca6be854d24fc293aa0583c5b5a8833b8f7f220e693aba48be81ae8d7916c9f63ee04ae4c4377a2
- TLSH
  T1784110225D011B1E4AF702AF6874D4C8FBC2517B821A69E4B6ACC44C9FF614FC650EFA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7 behavioral8