a90081b88415abc7843579b42cb1fd8075e9ff3b3155f44fd07820e1167dad06

Sharing

Copy URL Twitter E-mail

General

Target
mac-os-app-installer.dmg
Size 89.8MB
Sample260805-bc68gavemb
SHA256 a90081b88415abc7843579b42cb1fd8075e9ff3b3155f44fd07820e1167dad06
MD5 f331d8998a16191190f843f42cf2ff28
SHA1 336cd28ee04f5f584554e0145e3fe8f30251ab11
SHA512 2de14d76e1f5a437e8c04b90880a026f9544d6f3366b0f5715bf5461866f8149e23dac582caef62f3a57dc6b47e0325599593631536ce4acd3ab2acb655f5baa
SSDEEP 1572864:F3ml4W6cGdE3T7EO6vsyqtdsnhwZx30XUy7OcDF1clFBp2XB0sVQSGKd5MAAwdw+:1mWkAOSq8SS17OcDclFBp2XHVQSFkeB9
TLSH
T1B32833BFA13336C1ED4F66F49CA2746F1E5A0E6B913578820874935B3682FD94076E0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  mac-os-app-installer.dmg
- Size 89.8MB
- SHA256 a90081b88415abc7843579b42cb1fd8075e9ff3b3155f44fd07820e1167dad06
- MD5 f331d8998a16191190f843f42cf2ff28
- SHA1 336cd28ee04f5f584554e0145e3fe8f30251ab11
- SHA512 2de14d76e1f5a437e8c04b90880a026f9544d6f3366b0f5715bf5461866f8149e23dac582caef62f3a57dc6b47e0325599593631536ce4acd3ab2acb655f5baa
- SSDEEP 1572864:F3ml4W6cGdE3T7EO6vsyqtdsnhwZx30XUy7OcDF1clFBp2XB0sVQSGKd5MAAwdw+:1mWkAOSq8SS17OcDclFBp2XHVQSFkeB9
- TLSH
  T1B32833BFA13336C1ED4F66F49CA2746F1E5A0E6B913578820874935B3682FD94076E0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation
- Executes a macOS installer package script
  Adversaries use OS-specific installer packages and their resources to trigger the execution of malicious content, establishing persistence and elevating system privileges.
  persistence privilege_escalation
behavioral1
- Target
  O2 Cloud.localized/.DS_Store
- Size 10KB
- SHA256 f7c5cfdb84ca49da68305217114f2d467cb71d41c10ee71375db3adbec81db53
- MD5 e6a48b53618ddfe8435966afe589630d
- SHA1 f96441b0dee555125153a31999712eb9730850dd
- SHA512 44a8d72769d21830b9ecd400f8fe7730b37a123826c29a63bc1083b3507929122b357fa8d8da4723dbf68acd3fed2a21c22e56a76acb460b8901073db6cea2a7
- SSDEEP 96:SgQO+3LOiOkmKK/pWLHCl3M6uuM2mKK/6:Jg3CiD7gHuuT
- TLSH
  T158227416EBC58CAEF8A71B75CCA347302F21D4E0A3948713695A046A1C133CD0E73FA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2 behavioral3
- Target
  O2 Cloud.localized/.VolumeIcon.icns
- Size 137KB
- SHA256 d0ff8cc57562a1b646ac7d2c5ce2e02820a49b41e7b22e69e072aaab95b85495
- MD5 034cddc3a3607f51c5ce7076247cadb7
- SHA1 a9a7581fbffeb7d45fa8efc784fffa7b272ee01f
- SHA512 a99beace5516524ee84085f5dd5851d5833f2a6e1c72de8dd856d79cb1a394548e442c7e238c744760a98e2359b9191123da908af0f1a24848c81e2b3c25b485
- SSDEEP 1536:x6a2cqZuHVlHVS8l+/WLpB46OzupAg98l+/WLpB46OzupAghq/9vkMkXHWrjcasm:Z2/Zwl++BZOSAXl++BZOSAVvZ9pUG
- TLSH
  T171D3F1DE08511C26CDDB513A4E480D9BCA3CCC4D54BE247FA7B5FA5FAE37A10E6A4182
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4 behavioral5
- Target
  O2 Cloud.localized/.VolumeIcon.icns:com.apple.provenance
- Size 11B
- SHA256 5da7326444015cad1fbc84cde48abe4a4d68cde2d7d07e9cda5af2510c09f811
- MD5 4e4637665b7bba290ae1043f64f3613b
- SHA1 9d30503a576583b3e5ebb8db44a038a5f916b43c
- SHA512 278993b13ddc43cea2995736c1ab2bb88aabb374a17ecb34c07d452defba04ddee90f8551f172e6112c480cef8c1f99ea1dbad28c7b0b35237d5c1c50f33161e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral6 behavioral7
- Target
  O2 Cloud.localized/.background/installer_mac.jpg
- Size 4KB
- SHA256 47d5b7584d1aae4345b3483cca0098f71e85091fdc9d4b246efe9262db651922
- MD5 92b95fb8b539ff958299a6e4c4e579cf
- SHA1 9ce62c2498feae47fcda522708a3cf79d9136b23
- SHA512 517304892adf525e00e66a332d93934e7bd64b0a4bf1599d2f980f6bc4a988301e956a840bfdf55cac814d4ecfbf867844c738dab86d918adfc3d35a9ebcf5b9
- SSDEEP 48:wAnAgrd56CRbQexbEq+H/Zxm7lnjle714PNtqK+VeHfv8C75aVMl6/ganTlUVr4n:DAgBKexbWHXm7lng7yTaVeP75aV9Ta4L
- TLSH
  T1B491382BDE866529C41802301A094ABD3314302B3596F77EC670E026EEEEA81DC26CDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  O2 Cloud.localized/.background/installer_mac.jpg:com.apple.provenance
- Size 11B
- SHA256 5da7326444015cad1fbc84cde48abe4a4d68cde2d7d07e9cda5af2510c09f811
- MD5 4e4637665b7bba290ae1043f64f3613b
- SHA1 9d30503a576583b3e5ebb8db44a038a5f916b43c
- SHA512 278993b13ddc43cea2995736c1ab2bb88aabb374a17ecb34c07d452defba04ddee90f8551f172e6112c480cef8c1f99ea1dbad28c7b0b35237d5c1c50f33161e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral11
- Target
  O2 Cloud.localized/.background:com.apple.provenance
- Size 11B
- SHA256 5da7326444015cad1fbc84cde48abe4a4d68cde2d7d07e9cda5af2510c09f811
- MD5 4e4637665b7bba290ae1043f64f3613b
- SHA1 9d30503a576583b3e5ebb8db44a038a5f916b43c
- SHA512 278993b13ddc43cea2995736c1ab2bb88aabb374a17ecb34c07d452defba04ddee90f8551f172e6112c480cef8c1f99ea1dbad28c7b0b35237d5c1c50f33161e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral12 behavioral13
- Target
  O2 Cloud.localized/.localized/es.strings
- Size 33B
- SHA256 df8d4ee33cf01a1349db22a314bd8ceec8f771b491ea769cb0cc036f38cae77c
- MD5 d9827e2afb5b835026c5859233fe12dc
- SHA1 b780ffa83b842869bf8329994e3316bd74ee692c
- SHA512 69a16754e4d6307ace722fd1f9ac1789c3d17b51efbca777165cf17624c1be40740fb4a257af95bee16d7ef54e1ab4d56ab604c8986a6502e4907c5db8a70586
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral14 behavioral15
- Target
  O2 Cloud.localized/.localized/es.strings:com.apple.provenance
- Size 11B
- SHA256 5da7326444015cad1fbc84cde48abe4a4d68cde2d7d07e9cda5af2510c09f811
- MD5 4e4637665b7bba290ae1043f64f3613b
- SHA1 9d30503a576583b3e5ebb8db44a038a5f916b43c
- SHA512 278993b13ddc43cea2995736c1ab2bb88aabb374a17ecb34c07d452defba04ddee90f8551f172e6112c480cef8c1f99ea1dbad28c7b0b35237d5c1c50f33161e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral16 behavioral17
- Target
  O2 Cloud.localized/.localized:com.apple.provenance
- Size 11B
- SHA256 5da7326444015cad1fbc84cde48abe4a4d68cde2d7d07e9cda5af2510c09f811
- MD5 4e4637665b7bba290ae1043f64f3613b
- SHA1 9d30503a576583b3e5ebb8db44a038a5f916b43c
- SHA512 278993b13ddc43cea2995736c1ab2bb88aabb374a17ecb34c07d452defba04ddee90f8551f172e6112c480cef8c1f99ea1dbad28c7b0b35237d5c1c50f33161e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral18 behavioral19
- Target
  O2 Cloud.localized/.uninstaller/uninstaller-daemon.plist
- Size 476B
- SHA256 876c82f8ea73c253ea240559bcc93ed75f007945be297679869cb049071acfef
- MD5 33a3325a78b6b2099acb8ed8bdbaa1a6
- SHA1 067ce280e0e8decb3bcc6d49ed8ba4a02fe773f4
- SHA512 ffb6c724c1742734f82eba57adac15bcacc5243e10cbbda4eefcd011258080d24819c651816f4c577b5dd0735aa33b887961a7840a6b53b481233d2cd4cc9c66
- TLSH
  T19EF020A109F0D8AE19C12A0757E4A2194A81B28B2C7204FDB5CE3885CF0B85623364A8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral20 behavioral21
- Target
  O2 Cloud.localized/.uninstaller/uninstaller-daemon.plist:com.apple.provenance
- Size 11B
- SHA256 5da7326444015cad1fbc84cde48abe4a4d68cde2d7d07e9cda5af2510c09f811
- MD5 4e4637665b7bba290ae1043f64f3613b
- SHA1 9d30503a576583b3e5ebb8db44a038a5f916b43c
- SHA512 278993b13ddc43cea2995736c1ab2bb88aabb374a17ecb34c07d452defba04ddee90f8551f172e6112c480cef8c1f99ea1dbad28c7b0b35237d5c1c50f33161e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral22 behavioral23
- Target
  O2 Cloud.localized/.uninstaller/uninstaller-script.sh
- Size 710B
- SHA256 58fa81ca8a8b0dc142ac8b88162035751097be56cab3152aa72e53db07f10c1e
- MD5 13809fdf31e20c46dd0e38de8425a4a5
- SHA1 1da84b7d51e66f7bc1d37815cd789a6e22a468c7
- SHA512 731c874a0b3ec98fb99d2058ba195888d314b16f5eaf7fdfb7707529c3afac23eb2a6a6141b294427436166442e37d75e170448b1ab68d8a0cb174c5eb908889
- TLSH
  T1CD01CB1731D21A61ABEB802F1283040B8056310FCB09394039ED3BDD27CB2BB502993A
- MD5 SHA1 SHA512 TLSH
Score

6^/10

defense_evasion discovery privilege_escalation
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
behavioral24 behavioral25 behavioral26 behavioral27
- Target
  O2 Cloud.localized/.uninstaller/uninstaller-script.sh:com.apple.provenance
- Size 11B
- SHA256 5da7326444015cad1fbc84cde48abe4a4d68cde2d7d07e9cda5af2510c09f811
- MD5 4e4637665b7bba290ae1043f64f3613b
- SHA1 9d30503a576583b3e5ebb8db44a038a5f916b43c
- SHA512 278993b13ddc43cea2995736c1ab2bb88aabb374a17ecb34c07d452defba04ddee90f8551f172e6112c480cef8c1f99ea1dbad28c7b0b35237d5c1c50f33161e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral28 behavioral29
- Target
  O2 Cloud.localized/.uninstaller:com.apple.provenance
- Size 11B
- SHA256 5da7326444015cad1fbc84cde48abe4a4d68cde2d7d07e9cda5af2510c09f811
- MD5 4e4637665b7bba290ae1043f64f3613b
- SHA1 9d30503a576583b3e5ebb8db44a038a5f916b43c
- SHA512 278993b13ddc43cea2995736c1ab2bb88aabb374a17ecb34c07d452defba04ddee90f8551f172e6112c480cef8c1f99ea1dbad28c7b0b35237d5c1c50f33161e
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral30 behavioral31
- Target
  O2 Cloud.localized/Contents/MacOS/O2 Cloud
- Size 26B
- SHA256 d489f5f3980dcf7fc58ec0d48ab6967e9fdc086502ed01e80aa8a3f19e8aa410
- MD5 fd88e7f2db78ecd137618fcdd9983dee
- SHA1 4d6b3089b9da9f04d9b3e25eff9e7c37377f57b8
- SHA512 f42148bc9c82462eaa6cbcf0eba977811e1c098afe9b151093dcdffa5892a578c31b57d3868c88492850bd1643d5aac998a28fa2222e5df8e625d23d099990c4
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral32