Overview

overview

3

Static

static

1

usr/local/...pdater

macos-10.15-amd64

1

usr/local/...uncher

macos-10.15-amd64

1

postinstall

ubuntu-18.04-amd64

3

postinstall

debian-9-armhf

3

postinstall

debian-9-mips

3

postinstall

debian-9-mipsel

3

Analysis

  • max time kernel
    1s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    25/08/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    postinstall
  • Size 6KB
  • Sample260825-pgqm6shr4v
  • SHA256 e57b0fca769518280b362f6f1d0cfd5c451e7b74644370070c416db816dce6ef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/postinstall
    /tmp/postinstall
    1⤵
    • Writes file to tmp directory
    PID:645
    • /usr/bin/dirname
      dirname /Library/Logs/Microsoft/Sunfish/Updater/postinstall.log
      2⤵
        PID:654
      • /bin/mkdir
        mkdir -p /Library/Logs/Microsoft/Sunfish/Updater
        2⤵
        • Reads runtime system information
        PID:661
      • /bin/date
        date
        2⤵
          PID:666
        • /usr/bin/whoami
          whoami
          2⤵
            PID:668
          • /usr/bin/dirname
            dirname /tmp/postinstall
            2⤵
              PID:670
            • /bin/cat
              cat /tmp/version.txt
              2⤵
                PID:673
              • /usr/bin/tr
                tr -d "[:space:]"
                2⤵
                  PID:674
                • /bin/mkdir
                  mkdir -p "/Library/Application Support/Microsoft/Sunfish/Updater/Clients"
                  2⤵
                  • Reads runtime system information
                  PID:676
                • /bin/cat
                  cat
                  2⤵
                    PID:679
                  • /bin/chown
                    chown root:wheel "/Library/Application Support/Microsoft/Sunfish/Updater/Clients/SunfishUpdater.plist"
                    2⤵
                      PID:680
                    • /bin/chmod
                      chmod 0644 "/Library/Application Support/Microsoft/Sunfish/Updater/Clients/SunfishUpdater.plist"
                      2⤵
                        PID:682
                      • /bin/chmod
                        chmod 0644 "/Library/Application Support/Microsoft/Sunfish/Updater/refcount"
                        2⤵
                          PID:683
                        • /bin/date
                          date
                          2⤵
                            PID:685

                        Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              refcount
                              • Path /Library/Application Support/Microsoft/Sunfish/Updater/refcount
                              • Size 2B
                              • SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
                              • MD5 SHA1 SHA512
                              Submit Download

                              postinstall.log
                              • Path /Library/Logs/Microsoft/Sunfish/Updater/postinstall.log
                              • Size 1B
                              • SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
                              • MD5 SHA1 SHA512
                              Submit Download

                              postinstall.log
                              • Path /Library/Logs/Microsoft/Sunfish/Updater/postinstall.log
                              • Size 66B
                              • SHA256 d8fd6e3cbe1b9fc63051b429d0d8c1347daceb183048ac8a2b229caf6b05c619
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              postinstall.log
                              • Path /Library/Logs/Microsoft/Sunfish/Updater/postinstall.log
                              • Size 87B
                              • SHA256 c6d89b1281d3a0db5e7f5517f472ddd01f4ee130fe8ba8de8a3b86e2b7dbcc03
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              postinstall.log
                              • Path /Library/Logs/Microsoft/Sunfish/Updater/postinstall.log
                              • Size 118B
                              • SHA256 d7d588af9287717c2d13f0cc6cbac9fbee832407e6f3bd4d8cd16f39e94b7244
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              postinstall.log
                              • Path /Library/Logs/Microsoft/Sunfish/Updater/postinstall.log
                              • Size 510B
                              • SHA256 32b9c8b2ab46591375fd88af5fd78b6b11fd56a433a1c82d5403eeac868feb89
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              sh-thd.49DuoG
                              • Path /tmp/sh-thd.49DuoG
                              • Size 774B
                              • SHA256 cba93ab83eee03e328e4fa09e700f321a93345fc260fbf07b9e08596c6f7b9b8
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download