General
- Target AppleIDVerificationService
- Size 120KB
- Sample260827-pnhadavbld
- SHA256 08730fda7366104b1461b12834f55723381bf34a234947689c708b1ee431af69
Malware Config
Targets
-
- Target AppleIDVerificationService
- Size 120KB
- SHA256 08730fda7366104b1461b12834f55723381bf34a234947689c708b1ee431af69
Score7/10-
Exfiltration Over Alternative Protocol
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
-
Queries the macOS version information.
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
-
System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
-
Launch Agent
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Resource Forking
1Virtualization/Sandbox Evasion
1System Checks
1Discovery
System Information Discovery
1Virtualization/Sandbox Evasion
1System Checks
1