Overview

overview

7

Static

static

1

ae72f3886a9bdb1

macos-10.15-amd64

7

Analysis

  • user interaction
    yes
  • max time kernel
    102s
  • max time network
    103s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    09/08/2026, 00:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ae72f3886a9bdb1
  • Size 30.7MB
  • Sample260809-afgljsfh88
  • SHA256 2f50891e7068d12015942d3be39559c10b31affc937258f7b55113e5055e2007
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • System Checks 1 TTPs 1 IoCs

    Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

    defense_evasion
  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/ae72f3886a9bdb1\""
    1⤵
      PID:475
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/ae72f3886a9bdb1\""
      1⤵
        PID:475
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/ae72f3886a9bdb1
        1⤵
          PID:475
          • /bin/zsh
            /bin/zsh -c /Users/run/ae72f3886a9bdb1
            2⤵
              PID:476
            • /Users/run/ae72f3886a9bdb1
              /Users/run/ae72f3886a9bdb1
              2⤵
                PID:476
                • /usr/sbin/system_profiler
                  system_profiler SPHardwareDataType
                  3⤵
                    PID:477
                  • /usr/sbin/system_profiler
                    system_profiler SPDisplaysDataType
                    3⤵
                      PID:483
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.audio.AudioComponentRegistrar
                  1⤵
                    PID:506
                  • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                    /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                    1⤵
                      PID:506
                    • /usr/bin/bzip2
                      /usr/bin/bzip2 -f /var/log/wifi.log.0
                      1⤵
                        PID:513
                      • /bin/launchctl
                        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                        1⤵
                          PID:518
                        • /bin/launchctl
                          /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                          1⤵
                            PID:519
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                            1⤵
                              PID:521
                            • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                              /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                              1⤵
                                PID:521

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads