Overview

overview

8

Static

static

1

goyim.bat

macos-10.15-amd64

8

Resubmissions

16/07/2026, 23:08

260716-24ynhsfx8j8

10/06/2026, 18:21

260610-wzeryset7z1

Sharing

Copy URL Twitter E-mail

General

  • Target
    goyim
  • Size 92KB
  • Sample260716-24ynhsfx8j
  • SHA256 6c62012b703248a9be54cb3ad066506637d365bcacd44111fe484116f9058043
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverymacos

Malware Config

Targets

    • Target
      goyim
    • Size 92KB
    • SHA256 6c62012b703248a9be54cb3ad066506637d365bcacd44111fe484116f9058043
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscovery

    • Identifies memory size as anti-VM

    • Queries the macOS version information.

      An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Modify File

      Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

      defense_evasion

    • Timestomp

      Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks