Overview

overview

7

Static

static

1

jaffacakes...92.bin

macos-10.15-amd64

7

Analysis

  • max time kernel
    97s
  • max time network
    104s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    10/09/2026, 01:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_e5bba89c439cc9976bb5d0722d0e8c5857aa8ab50676bcfd4eb78dcb5b9c9f92.bin
  • Size 1.6MB
  • Sample260910-b7d56scm41
  • SHA256 e5bba89c439cc9976bb5d0722d0e8c5857aa8ab50676bcfd4eb78dcb5b9c9f92
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • System Checks 1 TTPs 4 IoCs

    Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

    defense_evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/jaffacakes118_e5bba89c439cc9976bb5d0722d0e8c5857aa8ab50676bcfd4eb78dcb5b9c9f92.bin\""
    1⤵
      PID:485
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/jaffacakes118_e5bba89c439cc9976bb5d0722d0e8c5857aa8ab50676bcfd4eb78dcb5b9c9f92.bin\""
      1⤵
        PID:485
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/jaffacakes118_e5bba89c439cc9976bb5d0722d0e8c5857aa8ab50676bcfd4eb78dcb5b9c9f92.bin
        1⤵
          PID:485
          • /bin/zsh
            /bin/zsh -c /Users/run/jaffacakes118_e5bba89c439cc9976bb5d0722d0e8c5857aa8ab50676bcfd4eb78dcb5b9c9f92.bin
            2⤵
              PID:486
            • /Users/run/jaffacakes118_e5bba89c439cc9976bb5d0722d0e8c5857aa8ab50676bcfd4eb78dcb5b9c9f92.bin
              /Users/run/jaffacakes118_e5bba89c439cc9976bb5d0722d0e8c5857aa8ab50676bcfd4eb78dcb5b9c9f92.bin
              2⤵
                PID:486
            • /bin/sh
              sh -c "osascript -e ' set memData to do shell script \"system_profiler SPMemoryDataType\" set hardwareData to do shell script \"system_profiler SPHardwareDataType\" if memData contains \"QEMU\" or memData contains \"VMware\" or memData contains \"KVM\" or hardwareData contains \"Z31FHXYQ0J\" or hardwareData contains \"C07T508TG1J2\" or hardwareData contains \"C02TM2ZBHX87\" or hardwareData contains \"Chip: Unknown\" or hardwareData contains \"Intel Core 2\" then set exitCode to 100 else set exitCode to 0 end if do shell script \"exit \" & exitCode '"
              1⤵
                PID:487
              • /bin/bash
                sh -c "osascript -e ' set memData to do shell script \"system_profiler SPMemoryDataType\" set hardwareData to do shell script \"system_profiler SPHardwareDataType\" if memData contains \"QEMU\" or memData contains \"VMware\" or memData contains \"KVM\" or hardwareData contains \"Z31FHXYQ0J\" or hardwareData contains \"C07T508TG1J2\" or hardwareData contains \"C02TM2ZBHX87\" or hardwareData contains \"Chip: Unknown\" or hardwareData contains \"Intel Core 2\" then set exitCode to 100 else set exitCode to 0 end if do shell script \"exit \" & exitCode '"
                1⤵
                  PID:487
                • /usr/bin/osascript
                  osascript -e " set memData to do shell script \"system_profiler SPMemoryDataType\" set hardwareData to do shell script \"system_profiler SPHardwareDataType\" if memData contains \"QEMU\" or memData contains \"VMware\" or memData contains \"KVM\" or hardwareData contains \"Z31FHXYQ0J\" or hardwareData contains \"C07T508TG1J2\" or hardwareData contains \"C02TM2ZBHX87\" or hardwareData contains \"Chip: Unknown\" or hardwareData contains \"Intel Core 2\" then set exitCode to 100 else set exitCode to 0 end if do shell script \"exit \" & exitCode "
                  1⤵
                    PID:487
                  • /bin/sh
                    sh -c "system_profiler SPMemoryDataType"
                    1⤵
                      PID:496
                    • /bin/bash
                      sh -c "system_profiler SPMemoryDataType"
                      1⤵
                        PID:496
                      • /usr/sbin/system_profiler
                        system_profiler SPMemoryDataType
                        1⤵
                          PID:496
                        • /bin/sh
                          sh -c "system_profiler SPHardwareDataType"
                          1⤵
                            PID:502
                          • /bin/bash
                            sh -c "system_profiler SPHardwareDataType"
                            1⤵
                              PID:502
                            • /usr/sbin/system_profiler
                              system_profiler SPHardwareDataType
                              1⤵
                                PID:502
                              • /bin/sh
                                sh -c "exit 100"
                                1⤵
                                  PID:505
                                • /bin/bash
                                  sh -c "exit 100"
                                  1⤵
                                    PID:505

                                  Network

                                        MITRE ATT&CK Enterprise v16

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads