21f76850a8ff08c1dd9c8905e974f3ec273331c6b014d59d599161c4272f0445

Analysis

user interaction
yes
max time kernel
144s
max time network
121s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
26/07/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
code.ps1
Size 553KB
Sample260726-1spe2adr9s
SHA256 21f76850a8ff08c1dd9c8905e974f3ec273331c6b014d59d599161c4272f0445
MD5 a712be6707d557c2a44fe78e3763f6c3
SHA1 0e2cf964fa706b3b837f65babc0a93419f73d1d6
SHA512 0c5a668e6e5dbdd9c6b2f856d832f238bd3bd18ac83dfcab60b48aa8b19ec1a617cc69ae53471612cf4d5d76c01f32fc76536b08054350323c7a25ff73115250
SSDEEP 1536:pJOPMkVBkNoo6G2De1rvCN/ilIYEDblF5EP6CgtDiC0o9c6k2xnY1uWjBoAK3oiZ:2LwDnZSFM99bh706Ymk
TLSH
T1F7C4BF17D8648C7B02F26374ADE98696F620932F9281181779FC806C4FBBDA74546F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/code.ps1\""
1⤵
PID:475

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/code.ps1\""
1⤵
PID:475

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/code.ps1
1⤵
PID:475
- /bin/zsh
  /bin/zsh -c /Users/run/code.ps1
  2⤵
  PID:478
- /Users/run/code.ps1
  /Users/run/code.ps1
  2⤵
  PID:478
- /bin/sh
  sh /Users/run/code.ps1
  2⤵
  PID:478
- /bin/bash
  sh /Users/run/code.ps1
  2⤵
  PID:478
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:686
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:955
- - openai/codex_client_type,
    "openai/codex_client_type, "
    3⤵
    PID:958
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:1074
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:1251
- - openai/codex_client_type
    "openai/codex_client_type "
    3⤵
    PID:1254
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:1441
- - openai/codex_client_type
    "openai/codex_client_type "
    3⤵
    PID:1444
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:1529
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:1710
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:1841
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:1977
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:2440
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:2909
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:3150
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:3328
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:3433
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:3660
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:4151
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:4254
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:4475
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:4968
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:5178
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:5403
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:5622
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:5848
- - openai/fileParams:
    openai/fileParams: "[ "
    3⤵
    PID:5849
- - openai/fileUploadConfig:
    openai/fileUploadConfig: "{ "
    3⤵
    PID:5852
- - openai/codex_client_type,
    "openai/codex_client_type, "
    3⤵
    PID:5857
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:6124
- - openai/codex_client_type
    "openai/codex_client_type "
    3⤵
    PID:6132
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:6320
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:6513
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:6780
- - openai/codex_client_type
    "openai/codex_client_type "
    3⤵
    PID:6783
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:6973
- - resources/list
    resources/list
    3⤵
    PID:7336
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:7747
- - resources/list
    resources/list
    3⤵
    PID:8129
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:8540
- - resources/list
    resources/list
    3⤵
    PID:8885
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:9298
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:9341
- - openai/userLocation
    "openai/userLocation "
    3⤵
    PID:9344
- - resources/list
    resources/list
    3⤵
    PID:9667
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:10078
- - resources/list
    resources/list
    3⤵
    PID:10400
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:10811
- - resources/list
    resources/list
    3⤵
    PID:11150
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:11561
- - resources/list
    resources/list
    3⤵
    PID:11995
- - openai/outputTemplate:
    openai/outputTemplate: "null, "
    3⤵
    PID:12406

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:2607

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:2607

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:6219

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:6219
- /usr/bin/login
  login -pf run
  2⤵
  PID:6311
- - /bin/zsh
    -zsh
    3⤵
    PID:6341
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:6344
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:6346

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:12423

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:12424

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:12425

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:12425

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads