fb432bc8801b740b608c3db90cccbb5ab02dfc5191f4a42aeddb5d96e1d154b3

General

Target
shitty ahh loader.zip
Size 3.4MB
Sample260805-baa29asvdv
SHA256 fb432bc8801b740b608c3db90cccbb5ab02dfc5191f4a42aeddb5d96e1d154b3
MD5 a910a9d46d6b8ca84c6d8340ea644a34
SHA1 244d2bccf9ab53fb4ac14474c0bc5b036df03b08
SHA512 1601c1b7d5a5b5fdc3eada5c616207eb802dec8554e92f950dd32b5d902f0da7123112e2d8e3728af86429aaf14b0db19e80e2074f4d6981b5352dbb91a0b2d6
SSDEEP 98304:jHv3rXeisEoFwt2D62dWLJbFCB29rtoGtg:7v7uEKCJnoGC
TLSH
T17DF533927B7808718A6C4CA3D3F86A62A44C37946EEF561DB00115CB5E4DE8ED72DCCE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/shitty ahh loader.zip\""
1⤵
PID:472

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/shitty ahh loader.zip\""
1⤵
PID:472

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/shitty ahh loader.zip"
1⤵
PID:472
- /bin/zsh
  /bin/zsh -c "/Users/run/shitty ahh loader.zip"
  2⤵
  PID:474
- /Users/run/shitty
  /Users/run/shitty ahh loader.zip
  2⤵
  PID:474

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:461

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:465

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:458

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:456

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:467

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.iChat.1880
1⤵
PID:508

/System/Applications/Messages.app/Contents/MacOS/Messages
/System/Applications/Messages.app/Contents/MacOS/Messages
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.toolbox.reporting.service
1⤵
PID:509

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 508
1⤵
PID:511

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.CharacterPicker.FileService
1⤵
PID:513

/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService
/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:514

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.contacts.donation-agent
1⤵
PID:518

/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:520

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:521

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:522

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:523

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:523
- /usr/bin/login
  login -pf run
  2⤵
  PID:524
- - /bin/zsh
    -zsh
    3⤵
    PID:527
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:529
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:530
  - - /usr/local/bin/cmd
      cmd
      4⤵
      PID:531
  - - /usr/bin/cmd
      cmd
      4⤵
      PID:531
  - - /bin/cmd
      cmd
      4⤵
      PID:531
  - - /usr/sbin/cmd
      cmd
      4⤵
      PID:531
  - - /sbin/cmd
      cmd
      4⤵
      PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:525

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:526

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:528

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.iChat//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH