0541c1cc937cf342396dce59b54a5e45ef0171412f24a44fd164034b527f0123

General

Target
MicrosoftTeamsInstaller.dmg
Size 263KB
Sample260820-wx7d7afb82
SHA256 0541c1cc937cf342396dce59b54a5e45ef0171412f24a44fd164034b527f0123
MD5 5d053aa648b660512b446074b3907c18
SHA1 0fcb6f7feb2905792765af90ac7d0a80816a3631
SHA512 836ef4adcac4358f52b0d97b24e0f72e1e4d2f42f05a3682880fa2449b898048c6063a6a96dab0d58636658e3c0f39ca15702439b6d5332cdcb6a6f381ab969f
SSDEEP 6144:HpNEHZrn/sTXrrPW+qFdlGRMIbBX8ynTBe9S3QTY:HpNIrETbr8F2bWySTY
TLSH
T1984413B92C0D2CE9CE0465F025745025CDFB3ECB98E284F2E69738A666F9E073A34557
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MicrosoftTeamsInstaller.dmg
- Size 263KB
- SHA256 0541c1cc937cf342396dce59b54a5e45ef0171412f24a44fd164034b527f0123
- MD5 5d053aa648b660512b446074b3907c18
- SHA1 0fcb6f7feb2905792765af90ac7d0a80816a3631
- SHA512 836ef4adcac4358f52b0d97b24e0f72e1e4d2f42f05a3682880fa2449b898048c6063a6a96dab0d58636658e3c0f39ca15702439b6d5332cdcb6a6f381ab969f
- SSDEEP 6144:HpNEHZrn/sTXrrPW+qFdlGRMIbBX8ynTBe9S3QTY:HpNIrETbr8F2bWySTY
- TLSH
  T1984413B92C0D2CE9CE0465F025745025CDFB3ECB98E284F2E69738A666F9E073A34557
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery exfiltration
- Prompts the user for their password using a hidden input dialog
  Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
  credential_access collection
- Exfiltration Over Alternative Protocol
  Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
  exfiltration
- Queries the macOS version information.
  An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
  discovery
- System Checks
  Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
  defense_evasion
behavioral1
- Target
  MicrosoftTeamsInstaller/MicrosoftTeamsInstaller.app/Contents/MacOS/MicrosoftTeamsInstaller
- Size 164KB
- SHA256 524b10f35d9c1c77344f37e60360c83cc50c1ae4f00d8c32ae8fba617d45955b
- MD5 f2ec820d698026a368dc2cc6b55b4a54
- SHA1 52e309b47df978255094ff8ca94ee2606485c718
- SHA512 80fa1a7b50421d2d45b4a80d9ec6227393ca0b9e3db28e143aca441601cf8a9d6c85a7d4859253f693958ba4b41ab138e64a80a24687baf44ac4993a8df80d9d
- SSDEEP 1536:VmXH04FIjnmdqHNlREeTvMq0H04FIjnmdqHNlREV:Vmk4FkmdqHNTXgs4FkmdqHNT
- TLSH
  T118F3D0763E384E47C4D4907575EA0348E922FE681E451B6BDF81E2658EB0780F09B3DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery exfiltration
- Prompts the user for their password using a hidden input dialog
  Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
  credential_access collection
- Exfiltration Over Alternative Protocol
  Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
  exfiltration
- Queries the macOS version information.
  An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
  discovery
- System Checks
  Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
  defense_evasion
behavioral2