7a7281ec920f9cec2db04b711d268cb3a1f56c559ccda8affabdec2aa6c1af86

Analysis

user interaction
yes
max time kernel
878s
max time network
880s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
22/09/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonClient.exe
Size 49KB
Sample260922-rn3messs9j
SHA256 7a7281ec920f9cec2db04b711d268cb3a1f56c559ccda8affabdec2aa6c1af86
MD5 563a063f62dcd942fda5cfc3171b925f
SHA1 a0a64d4573b076f29f5aafbace22d651fa632202
SHA512 11a660a23dd4a78865ad4d87789fa09e04520255266aae12da1650687f0c35fdaf973d3a309424988876acd5a81528e83e3f98aad79c26540fefa3bce8bdc7fd
SSDEEP 1536:EGM8+xvc3SPZtTYCMqhPhw4UTK1Heo3xxb1/rYKbOVKI:EQ+xvSiZtTYCMqhPhw4UTK1Heovb1/Zi
TLSH
T15F33C79CA7D94131E0BF56B21D77424893B0BAA38466D79F7CC401CA2727B958B41EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/MasonClient.exe\""
1⤵
PID:464

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/MasonClient.exe\""
1⤵
PID:464

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/MasonClient.exe
1⤵
PID:464
- /bin/zsh
  /bin/zsh -c /Users/run/MasonClient.exe
  2⤵
  PID:466
- /Users/run/MasonClient.exe
  /Users/run/MasonClient.exe
  2⤵
  PID:466

/usr/libexec/xpcproxy
xpcproxy com.apple.Photos.1876
1⤵
PID:512

/System/Applications/Photos.app/Contents/MacOS/Photos
/System/Applications/Photos.app/Contents/MacOS/Photos
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsync.useragent
1⤵
PID:513

/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:515

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:517

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:518

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:518
- /usr/bin/login
  login -pf run
  2⤵
  PID:519
- - /bin/zsh
    -zsh
    3⤵
    PID:521
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:522
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:523
- /usr/bin/login
  login -pfl run /bin/bash -c "exec -la zsh /bin/zsh"
  2⤵
  PID:527
- - /bin/bash
    bash -c "exec -la zsh /bin/zsh"
    3⤵
    PID:528
- - /bin/zsh
    -zsh
    3⤵
    PID:528
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:529
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:530
  - - /usr/local/bin/sudio
      sudio follow
      4⤵
      PID:531
  - - /usr/bin/sudio
      sudio follow
      4⤵
      PID:531
  - - /bin/sudio
      sudio follow
      4⤵
      PID:531
  - - /usr/sbin/sudio
      sudio follow
      4⤵
      PID:531
  - - /sbin/sudio
      sudio follow
      4⤵
      PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:520

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:524

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:525

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:526

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:536

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

.zsh_history

Path /Users/run/.zsh_history
Size 541B
SHA256 181b15ce02814a16cb2e360a620f2a684f0587024a1a5017b33d3586c35ecfee
MD5 c64c2ac01bf6f3ac9982c8df3a3d2908
SHA1 f20a1b0fdf8c5f3a3c30bc9cbc5f3ce0ac4b1297
SHA512 feb6aedce645f377daac4a9667c91c33fa2f5938e2715b3e5518e322b873c59afecb180f4c2abace5e9fa865a02c2fbef38f89bea298900f1d6f8795b1fb7215
TLSH
T15BF0F00F4548BCFABAD32A969E1641695742D8A2C0D31B10B2C5901FE926CA0C38BFA6
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Photos//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Photos//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.apple.colorsync.profiles.502

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.colorsync.profiles.502
Size 21KB
SHA256 f268fb6b71a54b7f655445ea60dffe3166ade5475d5221c33b13f49cd711a234
MD5 12c6d2422ba76752f124143e987c2e8d
SHA1 ddf94fa2daed6bf5e8bb6a4a16c1adb225131d0a
SHA512 5a42050913b910bf295cc83d3c990a93f9c2392e87e4aa8a134b5ea800c38e58404f46b8e5436f288572040d92bcb87fb57e6c2923b6e2a2d6e6e772b35c4cde
SSDEEP 48:l+B07+EorluafSDojes6GVYUWWZTlwje+d3elNVrJfZi1w8E5j9554bCBkYpdwh8:l+ZplfSDCeZG5uQFrfic59ZU96AeB
TLSH
T1E1A2FBB78BAC2242DAF27EF820F44EB55B37BB11F6676D6D44C616191A03C909270B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads