02e48b385186b961ec1eb873b3ac79cb15adf2816a2b58ce9f59e72988f03faa

General

Target
New Text Document жх(2).txt
Size 18B
Sample261002-3c2rjaxt2j
SHA256 02e48b385186b961ec1eb873b3ac79cb15adf2816a2b58ce9f59e72988f03faa
MD5 bb022f232404ea6ec27a410defb212d8
SHA1 39b60f319674f20ea26325f350c9fc751fbaf2e4
SHA512 b25f392131a1ac6440fb9c8f60d03682e882fe324bec6d25471fbda2348daf5404db0028f1688efb3c66f3d5db6319e93cd4df38a3d3c1d9e1314c9c8b62aef9
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Resource Forking 1 TTPs 3 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/New Text Document жх(2).txt\""
1⤵
PID:462

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/New Text Document жх(2).txt\""
1⤵
PID:462

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/New Text Document жх(2).txt"
1⤵
PID:462
- /bin/zsh
  /bin/zsh -c "/Users/run/New Text Document жх(2).txt"
  2⤵
  PID:463

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:499

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:505

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:509

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:508

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:511

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:513

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:512

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 506
1⤵
PID:518

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:518

/System/Applications/TV.app/Contents/MacOS/TV
/System/Applications/TV.app/Contents/MacOS/TV
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:521

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.D6206792-9921-4E46-ABF6-50F0850229DF 519
1⤵
PID:524

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:526

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:530

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:531

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.96941F69-D416-4970-B13D-60D557FFD224 519
1⤵
PID:532

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:535

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.SandboxHelper 524
1⤵
PID:536

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 524
1⤵
PID:537

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:537

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CompiledSandbox+_1YYzncKIoXjhjWCwKl267SpBYLvsZewldQMq9uV4SU

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.WebKit.WebContent.Sandbox/CompiledSandbox+_1YYzncKIoXjhjWCwKl267SpBYLvsZewldQMq9uV4SU
Size 48KB
SHA256 3dca99f87ab1858ed50e3b63aac64b90347492c50a53b3d4835a4609b1600f7c
MD5 220cf5e933e977986eb1004743b55d27
SHA1 b54cc29602d39247c7595cab725f678ec6de79cc
SHA512 379453af4dbc7f6b2082d04ba1c217f64448bf9ceaf602a4784f69a2e97641e39e28d2b6e21e47b0ee9af39fc918eeaad2aebab59ae2eb9456fb172e85d28bfe
SSDEEP 768:3di9c3hGLHzDxXn8ge2E6W7F+VzhH5w98ag6MQ:3d1CTDxXn8ge2EXYVtHeaE
TLSH
T183234F60F7A58C609ACB73AE683131019FAB866E92F8040077ADCF992F47C761175F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dafsaData.bin

Path /var/db/nsurlstoraged/dafsaData.bin
Size 56KB
SHA256 ceec06f21c7350cc12d5e56e79bff07ed9bdcbf3f22344a0a30703df6f9f1678
MD5 18342898ca9289afee7db51a6d8447e7
SHA1 48b408dd1904ca0e175129a8b0e8415055910530
SHA512 0a6dfd243e7df49c94f2a7d297f48506090b4b6cfab60a92692d5f5e1c69fbb4ecc523f250a2ab51e3b3d778d766c5986a026793f213280027372190e8cf4f96
SSDEEP 768:jIs6HFz/tldmC2rIxjfNCwi805lzrcb+/+Ppgv2M2V1+KWtHXtd0Hfh5BJJbEf+B:jPA1rg8jkwirzc+G2+/PfjJd0o
TLSH
T10243E1C57395D3893E5372A932026376E15DA1110FBB819CA70F591DCDBEE2F02C925E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

malware,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Size 239KB
SHA256 c8a12cb78642f5cbb51587fa2fef0011c7bcd05bb1e7a93d62420333b3c0f531
MD5 27192cb78c8fce9dc6d88845d8b5eca8
SHA1 e3f1d6563f11b99b860a151cab66212591744068
SHA512 1b6baf7425fe70d375baf7140cbe5e7f22f5539300159cb9952c66ae0de43e243074d02c37b821c466a63ba00b35da28da6b42cb210dba4294c4adff7fc2514e
SSDEEP 6144:iUNOBH3iV9IZXvNRdAp3sifIio0C0tlfN+i+7y:imyH+yNvbilBfpJDfAj7y
TLSH
T1743422BA8CB16FC80CB917DEAE66CD544DFC56DC2296437C3DCA49355F424A3480BA90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

social_engineering,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Size 15.9MB
SHA256 ebfc8f4d60a3fe9e967c36205645cf336b785222b03f1b610e1c18bae7f8fedc
MD5 7ddb0061c5dd57dd4a3aaf0ca2b33125
SHA1 a1088513386c472aa34442c396f9639863d3a966
SHA512 6fc188db821b720c9227ab3a5667ac2c08e7138dbc03dd333e758250a413f12235f8164a077fd6745547f73980eb21dadb452bb3aff4ca158aad13bb12ff0271
SSDEEP 393216:SXjXH3vtc8EPC8X+2ESym7HwULodKdi8driiLYivqdj6HCj+RH8CegyN:UjXHcL+DSym7y8i8kicivqq8CefN
TLSH
T123F633BF4BD417FBBD5B31EE6909F934522288061634DED83F46923940EA4ACCDB0697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unwanted_software,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Size 107KB
SHA256 dd9ecfe61bffeb79bfa4090f9c6681faa18a023b7374c44feba23807958335e6
MD5 4cde0223b24a5d08f5afa1da57a6f04c
SHA1 ecace4166de0d44d4fd6aaf608f66aaa3884773b
SHA512 348a17c9c0b9807fcf295a926521dbe04debc2fb508e0a8653eaa72ffed71364a9e46b8ba4c5197ff4201bdc559ce3b07129f0111f83bb6e8d96149b60b240d5
SSDEEP 1536:QPDYEO5xm3LrDZWIOkjtDmSJuQgCeBvCq0egDBNp7OYQRwWyt/h/Dxvi1U8C79Gy:QPMRmH0AjtNsQWCrMv6jJhVviG79GJ6f
TLSH
T113B312B8B9543796B3FFB25909C3D14B072DE6B11FE10829634A3215BA862FF45353B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads