482851377d81eba6b359cef2e968af3a0cc486cc4ef46716293b06878ac8ad43

General

Target
zeynep-oktay-zeynep-sude-oktay.gif
Size 3.6MB
Sample261023-wref8ac12w
SHA256 482851377d81eba6b359cef2e968af3a0cc486cc4ef46716293b06878ac8ad43
MD5 8e6af5ab62ad9f109fa813a3775c90c8
SHA1 d60da60ad4e7596309544fd258a8bfc08b59b6c1
SHA512 aac079de9453a0f9257b58078e00eae50d420a8d69908f8acb259aa597cafda75205a2db56af95676ff5c0cd2405c46aeee65ca3e77f0b2f89e28ad38022c1bf
SSDEEP 98304:IdM//8HeDCZGO16LHDuJtmgACTHcAnmpSP:Ida/aQCZUitmgAHw
TLSH
T1FE06332BF43E1412DA301E390FBD03850C8A981C12DE6AB75CA4395E9A84779D9F59FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Resource Forking 1 TTPs 6 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	installd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	storedownloadd
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	LWWeeklyMessageTracer
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Java Updater
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	storeuid

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/zeynep-oktay-zeynep-sude-oktay.gif\""
1⤵
PID:461

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/zeynep-oktay-zeynep-sude-oktay.gif\""
1⤵
PID:461

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/zeynep-oktay-zeynep-sude-oktay.gif
1⤵
PID:461
- /bin/zsh
  /bin/zsh -c /Users/run/zeynep-oktay-zeynep-sude-oktay.gif
  2⤵
  PID:463
- /Users/run/zeynep-oktay-zeynep-sude-oktay.gif
  /Users/run/zeynep-oktay-zeynep-sude-oktay.gif
  2⤵
  PID:463

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:449

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
- Resource Forking
PID:456

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:446

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:452

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
- Resource Forking
PID:457

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:487

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:487

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:488

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:488

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.DA2EE94C-62FE-4133-9431-73A2A2C70B78 487
1⤵
PID:489

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:489

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:494

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:494

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.DBF160BE-36BE-4F4D-8C9F-9FF26C237960 487
1⤵
PID:495

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:495

/usr/libexec/xpcproxy
xpcproxy com.apple.AppStore.1900
1⤵
PID:505

/System/Applications/App Store.app/Contents/MacOS/App Store
"/System/Applications/App Store.app/Contents/MacOS/App Store"
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:506

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
- Resource Forking
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 505
1⤵
PID:508

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.5F1659EA-0046-49C8-B073-2E3FC67FE9A7 487
1⤵
PID:509

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 487
1⤵
PID:511

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:514

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.AA40B32D-54E4-4DFC-945D-622759F6349C 487
1⤵
PID:515

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:524

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.SandboxHelper 515
1⤵
PID:525

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:526

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.068E06BB-AD0A-4FE8-B069-0F516EE2F799 487
1⤵
PID:527

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 515
1⤵
PID:528

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.962B42DB-D19A-48D9-BE94-4CB68876D433 487
1⤵
PID:529

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:530

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:540

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
- Resource Forking
PID:538

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
- Resource Forking
PID:540

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:533

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
- Resource Forking
PID:536

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 531
1⤵
PID:542

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:542

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2529545429CE075A4E64DE7DAA3D4C27

Path /Users/run/Library/Safari/Favicon Cache/favicons/2529545429CE075A4E64DE7DAA3D4C27
Size 5KB
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
SSDEEP 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
TLSH
T165B1B8B7E6C63030C85805BC49373A6D1E1B6EE31A9CF064FECC326A1A320D175256BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D58DB111F3EBFE8E2F310FBCEF38C748

Path /Users/run/Library/Safari/Favicon Cache/favicons/D58DB111F3EBFE8E2F310FBCEF38C748
Size 37KB
SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
MD5 231913fdebabcbe65f4b0052372bde56
SHA1 553909d080e4f210b64dc73292f3a111d5a0781f
SHA512 7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919
SSDEEP 768:PcaDYrV5KBau+3erpKn9jpe7z9mWAFjQcR4D9DQ0LKfjLh:PcsiV5Y+erc9T/H4f0jLh
TLSH
T170038DE82E4917AEE9E2CF324ADB6716237B4F88C0BC169742B07F193175A51C6D78C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

malware,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Size 339KB
SHA256 c6eb7cd5fad570925b6493b61876fa2b6b4ceb4e1b7718a7cdb5f839430ed2e3
MD5 34ac2e85b29a4f9b80cac86fbf3c7169
SHA1 9f2ae69f5bf6544e59c3b17a8fdab3c39b4c9d29
SHA512 75e2b5b9c8f7c01b6b6955db237bd6e40f1a7384584b5d23018c31f068dd4ffb0d2733ddcabb14034003686c0c86c3aba68715b30f707827da5c29ccaedcbfff
SSDEEP 6144:5z5fG8KWbW7UowHwqOxsu+w11c6wAAEojo5RNC70yYL6tVKBAjrUj:BEsWokXX+A1c6vpo6N6giKs4j
TLSH
T1FA7423AF88211970AC74129E3B7415470A9CF7E99EB1423EAD5FA13EEB025D34C7A8C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

social_engineering,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Size 15.9MB
SHA256 e1dd6aba4c551c97c35826ef7c88fbf9600e13cbf5f33941c8613c7a4bf0367e
MD5 86c4b6def31fd24710ebeb4e960e1e1b
SHA1 cfbe7a5ec8fe697cc99bc27c2a62ce28edac43c1
SHA512 7fe4023cf9774084326afd1035f7f7b208bafece0cfb06073ac8daa703c7ed02ef4a986d5f46f2d873b9b5e9d7666bbb00bafa70648f1b5f1db74fdc236a7805
SSDEEP 393216:PaegjoklRxVXRcJLP/CvCvLI1dp/HePU6qkmnSzMiuefgKTZQdlNf7e:Pae2BRcJLP6pp/HZ6JmnSzpZQDNfy
TLSH
T188F633774B9017ABBD6B31FD1E0DB9315612C8461724DEA82F46813B88DA9FCCE3425B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unwanted_software,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Size 108KB
SHA256 69340eb8d13f1cbec27d6ca42a7dc237adc621e4878cc96682705de6b4f9e86c
MD5 3dce8818325809ada1904a06f781469f
SHA1 dac57b595f48f5a1c7c240f32b25a6eeb7631f5b
SHA512 5c516d8fe580e6d8d95fbe3f737a9948c416c05506190858b44ce6569966634030404b438c4c8653de14200a54f6598a8bd34da89c8c4d13a30557c0a6738864
SSDEEP 3072:hll7eyc1DAdGs/SboVTZoP77sW7RqK3+XE:7ZYE/g7gOq4h
TLSH
T1F3B312AAF259679373FFF1AA0492920B571DD2743ED2083237897616ADC21FFC835660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads