275aeaa88d853ddb93c6e3c102beb1aa2ba41ca1b68af25b47781d9f4460bc5d

General

Target
y6b3fuzj0w6pt97e
Size 706KB
Sample260824-ag6basbf37
SHA256 275aeaa88d853ddb93c6e3c102beb1aa2ba41ca1b68af25b47781d9f4460bc5d
MD5 e1d35d2d895b0399bff341875f722173
SHA1 0d14d55fbefbbbdd37c29f1d5a16a3904a2929ed
SHA512 c4bae3263ffe861328818f5633016adeb7f6597002cf1b951e0dd687b020a413192f23dbcef3da2eb72a28e2ac46e3ac6fc160d3a10b5bd311eb3ca0738ae537
SSDEEP 12288:tU7wAcpxXAIIETE1UWLwJrr1nuwyhPUcyvmByHaRR1L+:tU7RyAOTtNvPaRW
TLSH
T1EEF42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access discovery execution

Malware Config

Signatures

Identifies hardware specifics through system_profiler 2 IoCs

ioc	Process
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"	Process not Found
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType	Process not Found

Prompts the user for their password using a hidden input dialog 1 TTPs 2 IoCs

Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.

credential_access collection

GUI Input Capture

T1056.002

ioc	Process
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"	Process not Found
osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"	Process not Found

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"	Process not Found
osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"	Process not Found

Checks the status of system security protections 1 TTPs 1 IoCs

System utilities were executed to query the status of System Integrity Protection or FileVault encryption. This can be abused to discover local security settings.

discovery

Security Software Discovery

T1518.001

ioc	Process
/usr/bin/csrutil status	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/y6b3fuzj0w6pt97e\""
1⤵
PID:472

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/y6b3fuzj0w6pt97e\""
1⤵
PID:472

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/y6b3fuzj0w6pt97e
1⤵
PID:472
- /bin/zsh
  /bin/zsh -c /Users/run/y6b3fuzj0w6pt97e
  2⤵
  PID:473
- /Users/run/y6b3fuzj0w6pt97e
  /Users/run/y6b3fuzj0w6pt97e
  2⤵
  PID:473

/bin/sh
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:475

/bin/bash
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:475
- /usr/bin/killall
  killall Terminal
  2⤵
  PID:476

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:477

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:477
- /usr/sbin/system_profiler
  system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
  2⤵
  PID:478

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:482

/bin/sh
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"
1⤵
PID:486

/bin/bash
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"
1⤵
PID:486
- /usr/bin/osascript
  osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"
  2⤵
  PID:488

/usr/sbin/kextcache
/usr/sbin/kextcache -F -system-prelinked-kernel
1⤵
PID:492

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:520

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:522

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:524

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 186
1⤵
PID:525

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:529

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:529