Overview

overview

8

Static

static

1

API_REFRESH.scpt

macos-10.15-amd64

8

Analysis

  • max time kernel
    70s
  • max time network
    130s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    22/08/2026, 08:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    API_REFRESH.scpt
  • Size 5KB
  • Sample260822-j59hasseqh
  • SHA256 0c394e5e1e6d15e605cc6ab62d50c8eee91f222d1e607df5c79f9a6251561fba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Identifies devices as anti-VM 2 IoCs
  • Queries the hardware information (I/O Kit registry). 1 TTPs 2 IoCs

    An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

    discovery

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"osascript /Users/run/API_REFRESH.scpt\""
    1⤵
      PID:462
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"osascript /Users/run/API_REFRESH.scpt\""
      1⤵
        PID:462
      • /usr/bin/sudo
        sudo /bin/zsh -c "osascript /Users/run/API_REFRESH.scpt"
        1⤵
          PID:462
          • /bin/zsh
            /bin/zsh -c "osascript /Users/run/API_REFRESH.scpt"
            2⤵
              PID:463
            • /usr/bin/osascript
              osascript /Users/run/API_REFRESH.scpt
              2⤵
                PID:463
            • /bin/sh
              sh -c "perl -e 'my(\$k,\$h)=@ARGV;my\$l=length\$k;my@b=map{hex}(\$h=~/[0-9a-f][0-9a-f]/gi);print map{chr(\$b[\$_]^ord(substr(\$k,\$_%\$l,1)))}0..\$#b' 'g9mX2kLp4nR7' '11545068094b251f460b35174a4b096912462f507d21025b064d0b3740060908440b2043235c1b31510e6c420a4136521116032d5e076c0c140920521719401d43026c5742032556155c112e5b193805550230581f451d39400a201c5102214b165c002d154b6a5614183f0a56024d30455668584717215413554d755c4b24071a033d5302554d6a0c44281542413c420b554463120e2f185b4e70130f4e4f784e4b2b02511e721a22480478151d2107551c374b11501f2c470a20571448741711545069094b3750440920521719403e121d2107551c371a115415784e176c00531c374747140b7864292308670b20410e5a08784e176c00531c374747140b784219202f40013d5b14024d251255631451187d591255017800556a411448741711545069094b29135c0172131154'"
              1⤵
                PID:464
              • /bin/bash
                sh -c "perl -e 'my(\$k,\$h)=@ARGV;my\$l=length\$k;my@b=map{hex}(\$h=~/[0-9a-f][0-9a-f]/gi);print map{chr(\$b[\$_]^ord(substr(\$k,\$_%\$l,1)))}0..\$#b' 'g9mX2kLp4nR7' '11545068094b251f460b35174a4b096912462f507d21025b064d0b3740060908440b2043235c1b31510e6c420a4136521116032d5e076c0c140920521719401d43026c5742032556155c112e5b193805550230581f451d39400a201c5102214b165c002d154b6a5614183f0a56024d30455668584717215413554d755c4b24071a033d5302554d6a0c44281542413c420b554463120e2f185b4e70130f4e4f784e4b2b02511e721a22480478151d2107551c374b11501f2c470a20571448741711545069094b3750440920521719403e121d2107551c371a115415784e176c00531c374747140b7864292308670b20410e5a08784e176c00531c374747140b784219202f40013d5b14024d251255631451187d591255017800556a411448741711545069094b29135c0172131154'"
                1⤵
                  PID:464
                • /usr/bin/perl
                  perl -e "my(\$k,\$h)=@ARGV;my\$l=length\$k;my@b=map{hex}(\$h=~/[0-9a-f][0-9a-f]/gi);print map{chr(\$b[\$_]^ord(substr(\$k,\$_%\$l,1)))}0..\$#b" g9mX2kLp4nR7 11545068094b251f460b35174a4b096912462f507d21025b064d0b3740060908440b2043235c1b31510e6c420a4136521116032d5e076c0c140920521719401d43026c5742032556155c112e5b193805550230581f451d39400a201c5102214b165c002d154b6a5614183f0a56024d30455668584717215413554d755c4b24071a033d5302554d6a0c44281542413c420b554463120e2f185b4e70130f4e4f784e4b2b02511e721a22480478151d2107551c374b11501f2c470a20571448741711545069094b3750440920521719403e121d2107551c371a115415784e176c00531c374747140b7864292308670b20410e5a08784e176c00531c374747140b784219202f40013d5b14024d251255631451187d591255017800556a411448741711545069094b29135c0172131154
                  1⤵
                    PID:464
                  • /usr/bin/perl5.18
                    perl -e "my(\$k,\$h)=@ARGV;my\$l=length\$k;my@b=map{hex}(\$h=~/[0-9a-f][0-9a-f]/gi);print map{chr(\$b[\$_]^ord(substr(\$k,\$_%\$l,1)))}0..\$#b" g9mX2kLp4nR7 11545068094b251f460b35174a4b096912462f507d21025b064d0b3740060908440b2043235c1b31510e6c420a4136521116032d5e076c0c140920521719401d43026c5742032556155c112e5b193805550230581f451d39400a201c5102214b165c002d154b6a5614183f0a56024d30455668584717215413554d755c4b24071a033d5302554d6a0c44281542413c420b554463120e2f185b4e70130f4e4f784e4b2b02511e721a22480478151d2107551c374b11501f2c470a20571448741711545069094b3750440920521719403e121d2107551c371a115415784e176c00531c374747140b7864292308670b20410e5a08784e176c00531c374747140b784219202f40013d5b14024d251255631451187d591255017800556a411448741711545069094b29135c0172131154
                    1⤵
                      PID:464
                    • /bin/sh
                      sh -c "vm=0; ioreg -rd1 -c IOPlatformExpertDevice 2>/dev/null | grep -Eqi 'vmware|virtualbox|parallels|qemu' && vm=1; hw=\$(sysctl -n hw.model 2>/dev/null); echo \"\$hw\" | grep -Eqi 'vmware|virtual' && vm=1; { pgrep -f vmware-vmx || pgrep -f VBoxService || pgrep -f prl_tools; } >/dev/null 2>&1 && vm=1; echo \$vm"
                      1⤵
                        PID:465
                      • /bin/bash
                        sh -c "vm=0; ioreg -rd1 -c IOPlatformExpertDevice 2>/dev/null | grep -Eqi 'vmware|virtualbox|parallels|qemu' && vm=1; hw=\$(sysctl -n hw.model 2>/dev/null); echo \"\$hw\" | grep -Eqi 'vmware|virtual' && vm=1; { pgrep -f vmware-vmx || pgrep -f VBoxService || pgrep -f prl_tools; } >/dev/null 2>&1 && vm=1; echo \$vm"
                        1⤵
                          PID:465
                          • /usr/bin/grep
                            grep -Eqi "vmware|virtualbox|parallels|qemu"
                            2⤵
                              PID:467
                            • /usr/sbin/ioreg
                              ioreg -rd1 -c IOPlatformExpertDevice
                              2⤵
                                PID:466
                              • /usr/bin/grep
                                grep -Eqi "vmware|virtual"
                                2⤵
                                  PID:471
                                • /usr/bin/pgrep
                                  pgrep -f vmware-vmx
                                  2⤵
                                    PID:472
                                  • /usr/bin/pgrep
                                    pgrep -f VBoxService
                                    2⤵
                                      PID:473
                                    • /usr/bin/pgrep
                                      pgrep -f prl_tools
                                      2⤵
                                        PID:474
                                    • /usr/sbin/sysctl
                                      sysctl -n hw.model
                                      1⤵
                                        PID:469
                                      • /usr/sbin/kextcache
                                        /usr/sbin/kextcache -F -system-prelinked-kernel
                                        1⤵
                                          PID:477
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.nsurlstoraged
                                          1⤵
                                            PID:507
                                          • /usr/libexec/nsurlstoraged
                                            /usr/libexec/nsurlstoraged --privileged
                                            1⤵
                                              PID:507
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.StreamingUnzipService 195
                                              1⤵
                                                PID:508
                                              • /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                                /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                                1⤵
                                                  PID:508

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads