4f838b1fe1f8df23c8134591652f91522c315ba01b8755d6865712f8b035ec8f

General

Target
invite.pkg
Size 28.2MB
Sample260804-vbmbfssygw
SHA256 4f838b1fe1f8df23c8134591652f91522c315ba01b8755d6865712f8b035ec8f
MD5 bd2dc94e73c85d1274a0ef3239e778a0
SHA1 f5e0ec99bb19c96c249bdf520e52d4507903b84e
SHA512 b076993f3e86916defdc4343220b1a507916a31a282c6b0c60432ac5c06202b01f6f415c622978ca2822bff62e5180bd65db80949494f7c43d3b4108055ae7ff
SSDEEP 786432:87q7jF2JOHzcWBzB5BqzBC8dy2ioz/kC/67wo:87q7kJOHqCAy2J/kCw
TLSH
T1EB5733E2BEECAE648862677797F4426334A5DC4528DF00F12A66D4C277B79308F63E05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

File and Directory Discovery. 1 TTPs 1 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
dirname /Users/run/setup.pkg	Process not Found

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:484

/bin/bash
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:484

/usr/bin/sudo
sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
1⤵
PID:484
- /bin/zsh
  /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
  2⤵
  PID:485
- /usr/sbin/installer
  installer -pkg /Users/run/setup.pkg -target /
  2⤵
  PID:485

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:486

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:486

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:487

/tmp/PKInstallSandbox.Jo5wEy/Scripts/com.centrastage.pkg.CAG.UTOJzy/preinstall
/tmp/PKInstallSandbox.Jo5wEy/Scripts/com.centrastage.pkg.CAG.UTOJzy/preinstall /Users/run/setup.pkg / / /
1⤵
PID:488

/bin/bash
/bin/sh /tmp/PKInstallSandbox.Jo5wEy/Scripts/com.centrastage.pkg.CAG.UTOJzy/preinstall /Users/run/setup.pkg / / /
1⤵
PID:488
- /usr/bin/touch
  touch /var/log/cag_install.log
  2⤵
  PID:490
- /bin/date
  date "+%d.%m.%y"
  2⤵
  PID:491
- /usr/bin/dirname
  dirname /Users/run/setup.pkg
  2⤵
  PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:498

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:498

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 198
1⤵
PID:499

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.04A51591-755B-442B-88C1-4024E01D315B 503
1⤵
PID:505

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:510

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.installer.2124
1⤵
PID:511

/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer
/System/Library/CoreServices/Installer.app/Contents/MacOS/Installer
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:517

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:515

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:516

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:520

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 513
1⤵
PID:523

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.security.agent
1⤵
PID:526

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authhost.00000000-0000-0000-0000-0000000186A5
1⤵
PID:527

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:528

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:529

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:529

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:530

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:530

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.security.agent
1⤵
PID:531

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authhost.00000000-0000-0000-0000-0000000186A5
1⤵
PID:532

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
1⤵
PID:532

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:533

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:533

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:534

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:534
- /usr/bin/login
  login -pf run
  2⤵
  PID:535
- - /bin/zsh
    -zsh
    3⤵
    PID:536
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:537
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:538

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

File and Directory Discovery

1

T1083

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installd.commit.pid

Path /private/var/run/installd.commit.pid
Size 3B
SHA256 86b700fab5db37977a73700b53a0654b21bdad0896914cc19ad70dee5f5fb3f6
MD5 7d04bbbe5494ae9d2f5a76aa1c00fa2f
SHA1 6cc71d91778fcdda0eb8709e9348240b251afe5e
SHA512 2d92ef7c0422e4c9d8932c0f905f15e726848465227fd0e80d618eccfa4a6dc58746575a7cccf887933e51c7ac057b97b0496df991786c4f5b37c2dd66e79bc9
MD5 SHA1 SHA512

Submit Download

preinstall

Path /tmp/PKInstallSandbox.Jo5wEy/Scripts/com.centrastage.pkg.CAG.UTOJzy/preinstall
Size 3KB
SHA256 35965e43fee5d4373d36a5e8bfc2c8ae31088ade18a860c6e30165fe96c9058a
MD5 2036eb9aea6fc34ab9cccef60e2b8241
SHA1 f98ad7ccce16b65bc6bfafae868e0fda98fba910
SHA512 87284b768444b07b19f97859071d96643cd3d656cdc914f0f9201c41d728ce62487706ee52c5553c6be475b17387fde3ed4b346ef1bfcbb57d2d0fc30b2c05bb
TLSH
T11F71732BF0449132ACD00F61960DAE50AE67F3EA26147D1430D6E5F5237D968B0BBA6B
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cag_install.log

Path /var/log/cag_install.log
Size 36B
SHA256 70fdb5a3f97c361f7ffc296274ddcc3e19e3da4babb3c0eec37a53779d672207
MD5 aeddfef3b17eaa8bd0202d8612bf580c
SHA1 cda2757143834e7c9c2806a87b781ef1faa33556
SHA512 809bde73d59c5a62a0fc87a58eacf44fa8261cff5025804b8d19f21ce57cc5777e0e9d95bd2dd092267ca17b3f3f0313ca83e6b29fd6fc1666ec093a35b048c0
MD5 SHA1 SHA512

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads