517b12e43361a6cdc056b54e85060272df44a97f7b69040d7b00441fa4aa49e6

General

Target
KakaoSetup.dmg
Size 199KB
Sample260804-pjf7hszfme
SHA256 517b12e43361a6cdc056b54e85060272df44a97f7b69040d7b00441fa4aa49e6
MD5 629e373d46ff80c40203137e9783a822
SHA1 540b1567a76f00553d3437a4032a0597faaa468b
SHA512 4d0030a310021b8b2646cd2f6249f3fa3e717ee4a9d91314114b4c99a081b9e6cb9e837126b5ec02010253cffc3e31cec1e4797f88f1967280d59dd0c38b8bcd
SSDEEP 6144:CpNEHZrn/sTXrrffEe5fMhZKxjLdU+f4gyOWY9:CpNIrETbb95BlpOOWY9
TLSH
T1471412BA984E3CA6CE2830F064B140684DDF3FC77DE1499AD9A37855F2E0E0A7A74417
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  KakaoSetup.dmg
- Size 199KB
- SHA256 517b12e43361a6cdc056b54e85060272df44a97f7b69040d7b00441fa4aa49e6
- MD5 629e373d46ff80c40203137e9783a822
- SHA1 540b1567a76f00553d3437a4032a0597faaa468b
- SHA512 4d0030a310021b8b2646cd2f6249f3fa3e717ee4a9d91314114b4c99a081b9e6cb9e837126b5ec02010253cffc3e31cec1e4797f88f1967280d59dd0c38b8bcd
- SSDEEP 6144:CpNEHZrn/sTXrrffEe5fMhZKxjLdU+f4gyOWY9:CpNIrETbb95BlpOOWY9
- TLSH
  T1471412BA984E3CA6CE2830F064B140684DDF3FC77DE1499AD9A37855F2E0E0A7A74417
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery exfiltration
- Prompts the user for their password using a hidden input dialog
  Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
  credential_access collection
- Exfiltration Over Alternative Protocol
  Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
  exfiltration
- Queries the macOS version information.
  An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
  discovery
- System Checks
  Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
  defense_evasion
behavioral1
- Target
  KakaoSetup/KakaoSetup.app/Contents/MacOS/KakaoSetup
- Size 163KB
- SHA256 8334ce6ee40a23d46aefdcd5655aa11f04b342c200576ddae216fc00358df42e
- MD5 5eec655e187bb48b5e7a966e93c226fc
- SHA1 1e446e4444c4ef39385c8bc11b9b42ca719d6770
- SHA512 74f3d7ab07038c3b912a78417ff6bd9349160fb893724a34b000ac103433ed732867c01a90010dfa951cbbc5632001d78c0ff50c41c921554bd37a0a0cee6007
- SSDEEP 1536:smfeLHekZKx/CU13v8CzMqMeLHekZKx/CU13v8:smmqkZKxd3vLAOqkZKxd3v
- TLSH
  T15CF3D0752BAE151AD0D941F050DBE752FB0DF3060EEFA383ADA0E7899CF0B455A099C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery exfiltration
- Prompts the user for their password using a hidden input dialog
  Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
  credential_access collection
- Exfiltration Over Alternative Protocol
  Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
  exfiltration
- Queries the macOS version information.
  An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
  discovery
- System Checks
  Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
  defense_evasion
behavioral2