General
- Target pearClient
- Size 63.3MB
- Sample260702-hd5vcsbx2j
- SHA256 f55d31f22e1c485aee04fbdae5f61150637742fca804f318dc4ca32273a2892c
Score
8/10
Malware Config
Targets
-
- Target pearClient
- Size 63.3MB
- SHA256 f55d31f22e1c485aee04fbdae5f61150637742fca804f318dc4ca32273a2892c
Score8/10-
Identifies memory size as anti-VM
-
Identifies physical CPU count as anti-VM
-
Launch Agent
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
-
Login Items
Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.
-
Queries the macOS version information.
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1AppleScript
1System Services
1Launchctl
1Persistence
Boot or Logon Autostart Execution
1Login Items
1Create or Modify System Process
1Launch Agent
1