84f04bb422a64f9b96a3f8fa5f7f23e9cfc31fb1e90099337fa8374bf6861bab

General

Target
WeChatInstaller.dmg
Size 299KB
Sample260913-pd2ahaah75
SHA256 84f04bb422a64f9b96a3f8fa5f7f23e9cfc31fb1e90099337fa8374bf6861bab
MD5 e3615ce0dff7520dfbeec14c3e5ac36e
SHA1 ceff8fc18f135ab6788ab452e44751c787bf1605
SHA512 c8737a0bd8808e801e2755a98a694de03ff52075dd32862c1d87491be27357be751a8aa542ad03fbecfff1aee4db89e5423a9515a6c828e505d27f9625187ed3
SSDEEP 6144:1pNEHZrn/sTXrrRD/zi8W/7EOf3Yjy5vbU9jh/AWogY3dUG/DofU4:1pNIrETb9DevzuwbU9jh/APgO56U4
TLSH
T1646423BE601E1C66CE1051FC3C7820B50CDF4ADB56E484BE8CA76CE910E9A29737995B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WeChatInstaller.dmg
- Size 299KB
- SHA256 84f04bb422a64f9b96a3f8fa5f7f23e9cfc31fb1e90099337fa8374bf6861bab
- MD5 e3615ce0dff7520dfbeec14c3e5ac36e
- SHA1 ceff8fc18f135ab6788ab452e44751c787bf1605
- SHA512 c8737a0bd8808e801e2755a98a694de03ff52075dd32862c1d87491be27357be751a8aa542ad03fbecfff1aee4db89e5423a9515a6c828e505d27f9625187ed3
- SSDEEP 6144:1pNEHZrn/sTXrrRD/zi8W/7EOf3Yjy5vbU9jh/AWogY3dUG/DofU4:1pNIrETb9DevzuwbU9jh/APgO56U4
- TLSH
  T1646423BE601E1C66CE1051FC3C7820B50CDF4ADB56E484BE8CA76CE910E9A29737995B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery exfiltration
- Prompts the user for their password using a hidden input dialog
  Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
  credential_access collection
- Exfiltration Over Alternative Protocol
  Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
  exfiltration
- Queries the macOS version information.
  An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
  discovery
- System Checks
  Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
  defense_evasion
behavioral1
- Target
  WeChatInstaller/WeChatInstaller.app/Contents/MacOS/WeChatInstaller
- Size 163KB
- SHA256 03d26fd80fecb351e0fd5e63ee3b15ca22287583520c0d0ba13ce83b47ee3bc0
- MD5 b610bbee85e8914b0825a323bf9e5a44
- SHA1 611413f39c5199f6bb0e60367561ed529601569e
- SHA512 cd8f60e6b34490ae39c60502f3fa074d3af13debae6a5fdeb3fec58ac2b2924a6ae4d0710645c5ced29ed7d8a81315b80bb4108034644b1d2453900e7f44d48c
- SSDEEP 1536:Sm8EjmxWoNnSDCqhm9ECBMqlEjmxWoNnSDCqhm9E:Sm8ZxWo1SDOKCuUZxWo1SDOK
- TLSH
  T1FAF3E1C2779DAE97C11FC3B4166A97F7AD1DF8005F22034A5C90CF540CE5BA82E1AE5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

collection credential_access defense_evasion discovery exfiltration
- Prompts the user for their password using a hidden input dialog
  Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
  credential_access collection
- Exfiltration Over Alternative Protocol
  Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
  exfiltration
- Queries the macOS version information.
  An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
  discovery
- System Checks
  Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.
  defense_evasion
behavioral2