Resubmissions
29/07/2026, 15:21
260729-srgd2aam9v1012/08/2025, 09:56
250812-lyc7mahl2z712/08/2025, 09:40
250812-lm9rfsyxbx712/08/2025, 09:39
250812-lmyn7aywhx4Analysis
- max time kernel
68s - max time network
126s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
29/07/2026, 15:21
Behavioral task
behavioral1
Sample
d46bbb399b19e476cc9c09db4b6a42fe4741439c88bafb8e6d9ed47061f2d315
Resource
macos-20250619-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
touchlock/.touchlock
Resource
macos-20250619-en
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
touchlock/touchlock.alk
Resource
ubuntu1804-amd64-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
touchlock/touchlock.alk
Resource
debian9-armhf-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
touchlock/touchlock.alk
Resource
debian9-mipsbe-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
touchlock/touchlock.alk
Resource
debian9-mipsel-20260513-en
0 signatures
150 seconds
General
- Target touchlock/.touchlock
- Size 1.4MB
- Sample260729-srgd2aam9v
- SHA256 9f8c5612c6bfe7ab528190294a9d5eca9e7dec3a7131463477ae103aeec5703b
- MD5 0223d73744d77554d9991d5dff0edb57
- SHA1 a98771946b70113d0b7f6416f34d5207de5965d4
- SHA512 916c3a3def4171494a83dbec56a2181b630e255c87d57e52ea27d252fbb5ba2a507f0adbfcf6a9aa9b5960fbeb0f82942a82f771cc2c52301b1b7994c0f03332
- SSDEEP 12288:MQXFW5Qp0Ht7fThK68lWXFW5Qp0Ht7fThK68l4h:9XFWjfP8MXFWjfP8+
- TLSH T18E65120EF6D67F6BDE4712331425118500CDED8613A0EB8BE5A18B7BB134BBD9C2B859
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/touchlock/.touchlock\""1⤵PID:457
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/touchlock/.touchlock\""1⤵PID:457
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/touchlock/.touchlock1⤵PID:457
-
/bin/zsh/bin/zsh -c /Users/run/touchlock/.touchlock2⤵PID:459
-
-
/Users/run/touchlock/.touchlock/Users/run/touchlock/.touchlock2⤵PID:459
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵PID:487
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵PID:487
-
/usr/libexec/xpcproxyxpcproxy com.apple.StreamingUnzipService 1981⤵PID:488
-
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService1⤵PID:488