11542046ff465e3b1b22e169ae584e138b64f89f0be5ea31992e99c7cacb7368 | Triage™

Login
Reports

Overview

overview

4

Static

static

4

Cofense_On...al.pdf

windows10-2004-x64

3

Cofense_On...al.pdf

windows11-ltsc_2024-x64

3

Cofense_On...22.pdf

windows10-2004-x64

3

Cofense_On...22.pdf

windows11-ltsc_2024-x64

3

Cofense_On...22.pdf

windows10-2004-x64

3

Cofense_On...22.pdf

windows11-ltsc_2024-x64

3

Global VPN...ta.key

macos-10.15-amd64

1

Global VPN...ta.key

macos-10.15-amd64

1

Cofense_On...ta.key

macos-10.15-amd64

1

Cofense_On...ta.key

macos-10.15-amd64

1

Cofense_On...ot.pdf

windows10-2004-x64

3

Cofense_On...ot.pdf

windows11-ltsc_2024-x64

3

Analysis

max time kernel
129s
max time network
112s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
30/09/2026, 00:23

Sharing

Copy URL Twitter E-mail

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

Cofense_Onbording/COFENSE GLOBAL CODE OF CONDUCT_12-30-22_Final.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral2

Sample

Cofense_Onbording/COFENSE GLOBAL CODE OF CONDUCT_12-30-22_Final.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral3

Sample

Cofense_Onbording/Cofense Global Export_Sanctions_AML Policy_Final 12-2022.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral4

Sample

Cofense_Onbording/Cofense Global Export_Sanctions_AML Policy_Final 12-2022.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral5

Sample

Cofense_Onbording/Cofense Global Gifts and Entertainment Policy_Final - 12-2022.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral6

Sample

Cofense_Onbording/Cofense Global Gifts and Entertainment Policy_Final - 12-2022.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral7

Sample

Global VPN - Full Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Global VPN - Split Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Cofense_Onbording/Global VPN v4/Global VPN - Full Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Cofense_Onbording/Global VPN v4/Global VPN - Split Tunnel v4/ta.key

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

Cofense_Onbording/self-guided-new-hire-setup - mot.pdf

Resource

win10v2004-20260911-en

windows10-2004-x64

7 signatures

150 seconds

adware discovery spyware

Behavioral task

behavioral12

Sample

Cofense_Onbording/self-guided-new-hire-setup - mot.pdf

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

7 signatures

150 seconds

adware discovery spyware

Report Analysis Logs

General

Target
Global VPN - Full Tunnel v4/ta.key
Size 657B
Sample260930-aptx8sshqd
SHA256 11542046ff465e3b1b22e169ae584e138b64f89f0be5ea31992e99c7cacb7368
MD5 200e5cf2c8a8f4ac4a02b7135ddea813
SHA1 f47e921c116a2aa305f81bf0034f8d9965852d5d
SHA512 91e0aaedff2e67cea1f4283aaaf62ecf19cc89768e56f72d11aa2974f9d6ffb0be8a2e7832066d92082a21fb030d5651c2fd74c6c89ec4234c7974fd6ed2a1e6
TLSH
T14F012367FEA8E491CD4DD4D37FD24636C73B5A01258D642340EA32032AB1B917B4CD64
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Processes

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:466

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Global VPN - Full Tunnel v4/ta.key\""
1⤵
PID:467

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Global VPN - Full Tunnel v4/ta.key\""
1⤵
PID:467

/usr/libexec/xpcproxy
xpcproxy com.apple.csrutil.report
1⤵
PID:468

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Global VPN - Full Tunnel v4/ta.key"
1⤵
PID:467
- /bin/zsh
  /bin/zsh -c "/Users/run/Global VPN - Full Tunnel v4/ta.key"
  2⤵
  PID:470
- /Users/run/Global
  /Users/run/Global VPN - Full Tunnel v4/ta.key
  2⤵
  PID:470

/usr/libexec/xpcproxy
xpcproxy com.apple.emond.aslmanager
1⤵
PID:469

/usr/sbin/aslmanager
/usr/sbin/aslmanager -s /var/log/eventmonitor
1⤵
PID:469

/usr/bin/csrutil
/usr/bin/csrutil report
1⤵
PID:468

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:466

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:502

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:518

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:518

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:526

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

wifi.log.0

Path /var/log/wifi.log.0
Size 2KB
SHA256 4e73ab437cebf94e205f1abfcd6cd860080f3fa4e5ee4b3416d56c081a10823d
MD5 ad690d46f929be42301c36068ecc8f3b
SHA1 fe77650b9f59db8b5083f15f39a734d15799af96
SHA512 2792769923027a2b6c8b2ab85d4a38492745ff6f70922035a7196456df9c37b58c2d28b28ba5c41cfc2116d5300ad1ed4ecf38011a1401833cb2d0d8d568c4f2
TLSH
T1D9517980167352BFDB7B318252299BBD5132811613CEA83CA57C79F51B8DAC223F3076
MD5 SHA1 SHA512 TLSH

Submit Download

wifi.log.0

Path /var/log/wifi.log.0
Size 126B
SHA256 2fe6e0ddf7ec949e1f4c1d5573f07cc9a37345ce60e3aad24b1f8688091841a4
MD5 fdcb3171e036c88699db3a50be132908
SHA1 a95704937d289020de1d38f6b9d549f15e4d344e
SHA512 7fd8584ad69c855202e2db2b1b41089c34da371f8071f93a0335a9546a5e45ed117d9526bf39462983dfc30e5e200611c1c71e7d5e8949d0f742030f12667adc
TLSH
T1B6B0920AC5FFB8A45142B08124394E162224B939FADAE47AB3CC6E55988C03CC659890
MD5 SHA1 SHA512 TLSH

Submit Download

© 2018-2026

Terms | Privacy