11542046ff465e3b1b22e169ae584e138b64f89f0be5ea31992e99c7cacb7368 | Triage™

Login
Reports

Overview

overview

4

Static

static

4

Cofense_On...al.pdf

windows10-2004-x64

3

Cofense_On...al.pdf

windows11-ltsc_2024-x64

3

Cofense_On...22.pdf

windows10-2004-x64

3

Cofense_On...22.pdf

windows11-ltsc_2024-x64

3

Cofense_On...22.pdf

windows10-2004-x64

3

Cofense_On...22.pdf

windows11-ltsc_2024-x64

3

Global VPN...ta.key

macos-10.15-amd64

1

Global VPN...ta.key

macos-10.15-amd64

1

Cofense_On...ta.key

macos-10.15-amd64

1

Cofense_On...ta.key

macos-10.15-amd64

1

Cofense_On...ot.pdf

windows10-2004-x64

3

Cofense_On...ot.pdf

windows11-ltsc_2024-x64

3

Analysis

max time kernel
70s
max time network
105s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
30/09/2026, 22:33

Sharing

Copy URL Twitter E-mail

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

Cofense_Onbording/COFENSE GLOBAL CODE OF CONDUCT_12-30-22_Final.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral2

Sample

Cofense_Onbording/COFENSE GLOBAL CODE OF CONDUCT_12-30-22_Final.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral3

Sample

Cofense_Onbording/Cofense Global Export_Sanctions_AML Policy_Final 12-2022.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral4

Sample

Cofense_Onbording/Cofense Global Export_Sanctions_AML Policy_Final 12-2022.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral5

Sample

Cofense_Onbording/Cofense Global Gifts and Entertainment Policy_Final - 12-2022.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral6

Sample

Cofense_Onbording/Cofense Global Gifts and Entertainment Policy_Final - 12-2022.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral7

Sample

Global VPN - Full Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Global VPN - Split Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Cofense_Onbording/Global VPN v4/Global VPN - Full Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Cofense_Onbording/Global VPN v4/Global VPN - Split Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

Cofense_Onbording/self-guided-new-hire-setup - mot.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral12

Sample

Cofense_Onbording/self-guided-new-hire-setup - mot.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

adware discovery spyware

Report Analysis Logs

General

Target
Global VPN - Full Tunnel v4/ta.key
Size 657B
Sample260930-2gr78a1ydw
SHA256 11542046ff465e3b1b22e169ae584e138b64f89f0be5ea31992e99c7cacb7368
MD5 200e5cf2c8a8f4ac4a02b7135ddea813
SHA1 f47e921c116a2aa305f81bf0034f8d9965852d5d
SHA512 91e0aaedff2e67cea1f4283aaaf62ecf19cc89768e56f72d11aa2974f9d6ffb0be8a2e7832066d92082a21fb030d5651c2fd74c6c89ec4234c7974fd6ed2a1e6
TLSH
T14F012367FEA8E491CD4DD4D37FD24636C73B5A01258D642340EA32032AB1B917B4CD64
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Processes

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Global VPN - Full Tunnel v4/ta.key\""
1⤵
PID:467

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Global VPN - Full Tunnel v4/ta.key\""
1⤵
PID:467

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Global VPN - Full Tunnel v4/ta.key"
1⤵
PID:467
- /bin/zsh
  /bin/zsh -c "/Users/run/Global VPN - Full Tunnel v4/ta.key"
  2⤵
  PID:469
- /Users/run/Global
  /Users/run/Global VPN - Full Tunnel v4/ta.key
  2⤵
  PID:469

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:492

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:493

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:493

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:501

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:501

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

dafsaData.bin

Path /var/db/nsurlstoraged/dafsaData.bin
Size 56KB
SHA256 ceec06f21c7350cc12d5e56e79bff07ed9bdcbf3f22344a0a30703df6f9f1678
MD5 18342898ca9289afee7db51a6d8447e7
SHA1 48b408dd1904ca0e175129a8b0e8415055910530
SHA512 0a6dfd243e7df49c94f2a7d297f48506090b4b6cfab60a92692d5f5e1c69fbb4ecc523f250a2ab51e3b3d778d766c5986a026793f213280027372190e8cf4f96
SSDEEP 768:jIs6HFz/tldmC2rIxjfNCwi805lzrcb+/+Ppgv2M2V1+KWtHXtd0Hfh5BJJbEf+B:jPA1rg8jkwirzc+G2+/PfjJd0o
TLSH
T10243E1C57395D3893E5372A932026376E15DA1110FBB819CA70F591DCDBEE2F02C925E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

© 2018-2026

Terms | Privacy