8641185630145365408de24b12ca8307b817c4b51d8f32b267904dcfd16a06de

General

Target
Radio Silence 3.3/Radio_Silence_3.3.pkg
Size 1.1MB
Sample260808-v5yxcaar2x
SHA256 8641185630145365408de24b12ca8307b817c4b51d8f32b267904dcfd16a06de
MD5 fb4bf61cc7320f0163143a9576d26462
SHA1 2200b65a3246efabb75842da4cf32ad75bbebefa
SHA512 bf59fb602439525cb05720204f03976f8c7f40de607ac3b61de9515e154dfc76b0ce6f0a7d39b6da9960bd220ef12d482d966bb1ab2497ccfdb0cdb690a52d4b
SSDEEP 24576:n3fA3MaYRIWh1BTeQFVfpVebFdJXiUbWdKoSLILfyqstzqUqJ7CLOxl:3I3EjBFhYbFdkUbSKoS0Lfy9qQLOxl
TLSH
T17045337CD36837F2F5B1FF311BAE225F2D46509A61B4F438522AD03EB56E594A30848B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

AppleScript 1 TTPs 1 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
/usr/bin/osascript -e "quit app \"Radio Silence\""	Process not Found

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update "/Library/InstallerSandboxes/.PKInstallSandboxManager/1DBB291B-7B16-4BAC-95F4-4D30DB119332.activeSandbox/Root/Applications/Radio Silence.app"	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/1DBB291B-7B16-4BAC-95F4-4D30DB119332.activeSandbox/Root /	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:478

/bin/bash
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:478

/usr/bin/sudo
sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
1⤵
PID:478
- /bin/zsh
  /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
  2⤵
  PID:479
- /usr/sbin/installer
  installer -pkg /Users/run/setup.pkg -target /
  2⤵
  PID:479

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:498

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:498

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update "/Library/InstallerSandboxes/.PKInstallSandboxManager/1DBB291B-7B16-4BAC-95F4-4D30DB119332.activeSandbox/Root/Applications/Radio Silence.app"
1⤵
PID:503

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:504

/tmp/PKInstallSandbox.ATArdN/Scripts/com.radiosilenceapp.client.bxjjsM/preinstall
/tmp/PKInstallSandbox.ATArdN/Scripts/com.radiosilenceapp.client.bxjjsM/preinstall /Users/run/setup.pkg / / /
1⤵
PID:505

/bin/bash
bash /tmp/PKInstallSandbox.ATArdN/Scripts/com.radiosilenceapp.client.bxjjsM/preinstall /Users/run/setup.pkg / / /
1⤵
PID:505
- /usr/bin/osascript
  /usr/bin/osascript -e "quit app \"Radio Silence\""
  2⤵
  PID:506
- /sbin/kextunload
  /sbin/kextunload -b com.radiosilenceapp.nke.filter
  2⤵
  PID:507
- /sbin/kextunload
  /sbin/kextunload -b com.radiosilenceapp.nke.filter
  2⤵
  PID:508

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/1DBB291B-7B16-4BAC-95F4-4D30DB119332.activeSandbox/Root /
1⤵
PID:509

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:534

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:534

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

AppleScript

1

T1059.002

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.radiosilenceapp.client.bom

Path /Library/InstallerSandboxes/.PKInstallSandboxManager/1DBB291B-7B16-4BAC-95F4-4D30DB119332.activeSandbox/Boms/com.radiosilenceapp.client.bom
Size 42KB
SHA256 b3f0e2afa0cfec2a66b192afc643b01a32a092808ebbfceaca6201223256c6f4
MD5 c11536d40a7d90d56acc4c3408ca19d3
SHA1 83d57d564d4e31ad32169b230c2a4f7841cb96c3
SHA512 366fccbca535e91fef499cd5710f469dfe3ae5c84555155b4c176e51de54e2c2037ecbefd8cfa2eee68141a9f77eac6c375db69bc9ed165f8958b3ae4eebd716
SSDEEP 192:foxgonh2DvlhZAXAtXvRhkIeK1+oz/bz:QOon4rlhZAQ/YKU+
TLSH
T19513100337901991D4280C769AF7AF8C1B12FA3966446F4F9CC5724ADCF5188DFAAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._com.radiosilenceapp.agent.plist__

Path /Library/InstallerSandboxes/.PKInstallSandboxManager/1DBB291B-7B16-4BAC-95F4-4D30DB119332.activeSandbox/Root//Library/LaunchAgents/._com.radiosilenceapp.agent.plist__
Size 176B
SHA256 1aa0ae7607e1b9c0a2048cabcd5a5493194eba5af26440a49e172aa5cf42e93a
MD5 0e80cfc58d354ed43c8c7ba15862b8de
SHA1 dbb310dac39c6de3946eef533cd79574fc42b641
SHA512 aa109343c5ca8ae2f0c6cfe9ea45a064d5c0b7c1e60775b54788fa4e0f5db84a3d765679a8214868b471dfb1d740eb5c392ee57c5fcee720556bae5bda6dbc31
TLSH
T167C012691006ADD1C44DC0704C8E5150F135E16843A28D13F69D80A04704F31FDBCA6A
MD5 SHA1 SHA512 TLSH

Submit Download

Info.plist

Path /Library/InstallerSandboxes/.PKInstallSandboxManager/1DBB291B-7B16-4BAC-95F4-4D30DB119332.activeSandbox/Root/Applications/Radio Silence.app/Contents/Info.plist
Size 1KB
SHA256 705c93cf58bbd9d0c4e37a6c7642edbf7e1106bf2d329520b7eccca35cadd6b8
MD5 52bddeed35f5e6d7c6cebd6b2f4a0b42
SHA1 2fab0bb8890f3ad8357c90bccf50430917d57e9e
SHA512 dbb372b8affba3473bd49e9c621d203f0f80f6b2c97e76ce3ddab306a352cb90ded2b361e65828ad36c87f7a0c4c171444c640a8c6c4c21aa29349c6ca74710c
TLSH
T10C31D6F50A1C35982DC113A71AD6510F01D861CC4C3362FEFEC6AA6DAE0E906A375EE5
MD5 SHA1 SHA512 TLSH

Submit Download

installd.commit.pid

Path /private/var/run/installd.commit.pid
Size 3B
SHA256 f138665c5aa6600801452ebb40df70c46e73f2c51f4cb72f66b438139c5ec3f6
MD5 05f971b5ec196b8c65b75d2ef8267331
SHA1 d049c44e2fd67b6eb19a1c18c93110c0b52cab63
SHA512 ba0b0519f2361a988db0251db3c93f813080bf9f95df721e08bae096d8c926bf9aaf8744a380d1453c7664c9fb191d960ae5f95bb207cc3c5f1239c7e9a2ca1e
MD5 SHA1 SHA512

Submit Download

preinstall

Path /tmp/PKInstallSandbox.ATArdN/Scripts/com.radiosilenceapp.client.bxjjsM/preinstall
Size 178B
SHA256 44c7ebecc57a9b1c6f492968c8d63bb1fb29b807f7cfc270be31bde6504e497c
MD5 3e9402f74815612e70d4978f64f0f6cb
SHA1 98a939b198480f91c1eeafbd5c34606d33387532
SHA512 290b892d1742740cc57db26e4f6d21828dfcbfbfcac24b18c9c32cf29ea6e00c3fdf23a1b5faa47aab9590e1c2bc102d2f100b55b04334a5d69ff1b54adb295b
TLSH
T1D2C080D0CDE84C735470DDAEEEBE4B4B605501993C54B79050DC7302E91E7D05C08514
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads