Overview

overview

10

Static

static

10

2026-10-29...ekoobe

macos-10.15-amd64

5

Analysis

  • max time kernel
    145s
  • max time network
    125s
  • platform
    macos-10.15_amd64
  • resource
    macos-20260915-en
  • resource tags

    arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    29/10/2026, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-29_1a95813405bb22d9d96a1d5de45e66c9_adload_evilquest_rekoobe
  • Size 168KB
  • Sample261029-vbk4dsbg37
  • SHA256 971ebebf667ae882b1e59cd14e7283a88bd14141c90c8edda58558a45dc7342e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
executionpersistence

Malware Config

Signatures

  • Launch Agent 1 TTPs

    Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

    persistence
  • Launch Daemon 1 TTPs

    Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

    persistence
  • AppleScript 1 TTPs 12 IoCs

    AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

    execution
  • Modifies service states with Launchctl 1 TTPs 24 IoCs

    Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2026-10-29_1a95813405bb22d9d96a1d5de45e66c9_adload_evilquest_rekoobe\""
    1⤵
      PID:464
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2026-10-29_1a95813405bb22d9d96a1d5de45e66c9_adload_evilquest_rekoobe\""
      1⤵
        PID:464
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2026-10-29_1a95813405bb22d9d96a1d5de45e66c9_adload_evilquest_rekoobe
        1⤵
          PID:464
          • /bin/zsh
            /bin/zsh -c /Users/run/2026-10-29_1a95813405bb22d9d96a1d5de45e66c9_adload_evilquest_rekoobe
            2⤵
              PID:465
            • /Users/run/2026-10-29_1a95813405bb22d9d96a1d5de45e66c9_adload_evilquest_rekoobe
              /Users/run/2026-10-29_1a95813405bb22d9d96a1d5de45e66c9_adload_evilquest_rekoobe
              2⤵
                PID:465
                • /bin/sh
                  sh -c "sysctl -n hw.ncpu"
                  3⤵
                    PID:466
                  • /bin/bash
                    sh -c "sysctl -n hw.ncpu"
                    3⤵
                      PID:466
                    • /usr/sbin/sysctl
                      sysctl -n hw.ncpu
                      3⤵
                        PID:466
                      • /bin/sh
                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:490
                      • /bin/bash
                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:490
                      • /usr/bin/osascript
                        osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:490
                      • /bin/sh
                        sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:494
                      • /bin/bash
                        sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:494
                      • /usr/bin/osascript
                        osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:494
                      • /bin/sh
                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:497
                      • /bin/bash
                        sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:497
                      • /usr/bin/osascript
                        osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:497
                      • /bin/sh
                        sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:499
                      • /bin/bash
                        sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:499
                      • /usr/bin/osascript
                        osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
                        3⤵
                        • AppleScript
                        • Modifies service states with Launchctl
                        PID:499
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.security.authtrampoline
                    1⤵
                      PID:491
                    • /System/Library/Frameworks/Security.framework/authtrampoline
                      /System/Library/Frameworks/Security.framework/authtrampoline
                      1⤵
                        PID:491
                        • /bin/sh
                          /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                          2⤵
                          • Modifies service states with Launchctl
                          PID:492
                        • /bin/bash
                          /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                          2⤵
                          • Modifies service states with Launchctl
                          PID:492
                        • /bin/launchctl
                          launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
                          2⤵
                          • Modifies service states with Launchctl
                          PID:492
                        • /bin/sh
                          /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                          2⤵
                          • Modifies service states with Launchctl
                          PID:496
                        • /bin/bash
                          /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
                          2⤵
                          • Modifies service states with Launchctl
                          PID:496
                        • /bin/launchctl
                          launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
                          2⤵
                          • Modifies service states with Launchctl
                          PID:496
                        • /bin/sh
                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                          2⤵
                          • Modifies service states with Launchctl
                          PID:498
                        • /bin/bash
                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                          2⤵
                          • Modifies service states with Launchctl
                          PID:498
                        • /bin/launchctl
                          launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
                          2⤵
                          • Modifies service states with Launchctl
                          PID:498
                        • /bin/sh
                          /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                          2⤵
                          • Modifies service states with Launchctl
                          PID:500
                        • /bin/bash
                          /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
                          2⤵
                          • Modifies service states with Launchctl
                          PID:500
                        • /bin/launchctl
                          launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
                          2⤵
                          • Modifies service states with Launchctl
                          PID:500
                      • /usr/libexec/xpcproxy
                        xpcproxy afsvcpd
                        1⤵
                          PID:493
                        • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                          /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                          1⤵
                            PID:493
                            • /bin/sh
                              sh -c "sysctl -n hw.ncpu"
                              2⤵
                                PID:495
                              • /bin/bash
                                sh -c "sysctl -n hw.ncpu"
                                2⤵
                                  PID:495
                                • /usr/sbin/sysctl
                                  sysctl -n hw.ncpu
                                  2⤵
                                    PID:495
                                • /usr/libexec/xpcproxy
                                  xpcproxy afsvcpd
                                  1⤵
                                    PID:501
                                  • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                    /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                    1⤵
                                      PID:501
                                      • /bin/sh
                                        sh -c "sysctl -n hw.ncpu"
                                        2⤵
                                          PID:502
                                        • /bin/bash
                                          sh -c "sysctl -n hw.ncpu"
                                          2⤵
                                            PID:502
                                          • /usr/sbin/sysctl
                                            sysctl -n hw.ncpu
                                            2⤵
                                              PID:502
                                          • /usr/libexec/xpcproxy
                                            xpcproxy afsvcpd
                                            1⤵
                                              PID:509
                                            • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                              /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                              1⤵
                                                PID:509
                                                • /bin/sh
                                                  sh -c "sysctl -n hw.ncpu"
                                                  2⤵
                                                    PID:510
                                                  • /bin/bash
                                                    sh -c "sysctl -n hw.ncpu"
                                                    2⤵
                                                      PID:510
                                                    • /usr/sbin/sysctl
                                                      sysctl -n hw.ncpu
                                                      2⤵
                                                        PID:510
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy afsvcpd
                                                      1⤵
                                                        PID:512
                                                      • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                        /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                        1⤵
                                                          PID:512
                                                          • /bin/sh
                                                            sh -c "sysctl -n hw.ncpu"
                                                            2⤵
                                                              PID:513
                                                            • /bin/bash
                                                              sh -c "sysctl -n hw.ncpu"
                                                              2⤵
                                                                PID:513
                                                              • /usr/sbin/sysctl
                                                                sysctl -n hw.ncpu
                                                                2⤵
                                                                  PID:513
                                                              • /usr/libexec/xpcproxy
                                                                xpcproxy afsvcpd
                                                                1⤵
                                                                  PID:516
                                                                • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                  /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                  1⤵
                                                                    PID:516
                                                                    • /bin/sh
                                                                      sh -c "sysctl -n hw.ncpu"
                                                                      2⤵
                                                                        PID:517
                                                                      • /bin/bash
                                                                        sh -c "sysctl -n hw.ncpu"
                                                                        2⤵
                                                                          PID:517
                                                                        • /usr/sbin/sysctl
                                                                          sysctl -n hw.ncpu
                                                                          2⤵
                                                                            PID:517
                                                                        • /usr/libexec/xpcproxy
                                                                          xpcproxy afsvcpd
                                                                          1⤵
                                                                            PID:519
                                                                          • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                            /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                            1⤵
                                                                              PID:519
                                                                              • /bin/sh
                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                2⤵
                                                                                  PID:520
                                                                                • /bin/bash
                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                  2⤵
                                                                                    PID:520
                                                                                  • /usr/sbin/sysctl
                                                                                    sysctl -n hw.ncpu
                                                                                    2⤵
                                                                                      PID:520
                                                                                  • /usr/libexec/xpcproxy
                                                                                    xpcproxy afsvcpd
                                                                                    1⤵
                                                                                      PID:522
                                                                                    • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                      /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                      1⤵
                                                                                        PID:522
                                                                                        • /bin/sh
                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                          2⤵
                                                                                            PID:523
                                                                                          • /bin/bash
                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                            2⤵
                                                                                              PID:523
                                                                                            • /usr/sbin/sysctl
                                                                                              sysctl -n hw.ncpu
                                                                                              2⤵
                                                                                                PID:523
                                                                                            • /usr/libexec/xpcproxy
                                                                                              xpcproxy afsvcpd
                                                                                              1⤵
                                                                                                PID:526
                                                                                              • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                1⤵
                                                                                                  PID:526
                                                                                                  • /bin/sh
                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                    2⤵
                                                                                                      PID:527
                                                                                                    • /bin/bash
                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                      2⤵
                                                                                                        PID:527
                                                                                                      • /usr/sbin/sysctl
                                                                                                        sysctl -n hw.ncpu
                                                                                                        2⤵
                                                                                                          PID:527
                                                                                                      • /usr/libexec/xpcproxy
                                                                                                        xpcproxy afsvcpd
                                                                                                        1⤵
                                                                                                          PID:528
                                                                                                        • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                          /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                          1⤵
                                                                                                            PID:528
                                                                                                            • /bin/sh
                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                              2⤵
                                                                                                                PID:529
                                                                                                              • /bin/bash
                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                2⤵
                                                                                                                  PID:529
                                                                                                                • /usr/sbin/sysctl
                                                                                                                  sysctl -n hw.ncpu
                                                                                                                  2⤵
                                                                                                                    PID:529
                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                  xpcproxy afsvcpd
                                                                                                                  1⤵
                                                                                                                    PID:533
                                                                                                                  • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                    /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                    1⤵
                                                                                                                      PID:533
                                                                                                                      • /bin/sh
                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                        2⤵
                                                                                                                          PID:534
                                                                                                                        • /bin/bash
                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                          2⤵
                                                                                                                            PID:534
                                                                                                                          • /usr/sbin/sysctl
                                                                                                                            sysctl -n hw.ncpu
                                                                                                                            2⤵
                                                                                                                              PID:534
                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                            xpcproxy afsvcpd
                                                                                                                            1⤵
                                                                                                                              PID:535
                                                                                                                            • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                              /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                              1⤵
                                                                                                                                PID:535
                                                                                                                                • /bin/sh
                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                  2⤵
                                                                                                                                    PID:536
                                                                                                                                  • /bin/bash
                                                                                                                                    sh -c "sysctl -n hw.ncpu"
                                                                                                                                    2⤵
                                                                                                                                      PID:536
                                                                                                                                    • /usr/sbin/sysctl
                                                                                                                                      sysctl -n hw.ncpu
                                                                                                                                      2⤵
                                                                                                                                        PID:536
                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                      xpcproxy afsvcpd
                                                                                                                                      1⤵
                                                                                                                                        PID:537
                                                                                                                                      • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                        /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                        1⤵
                                                                                                                                          PID:537
                                                                                                                                          • /bin/sh
                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                            2⤵
                                                                                                                                              PID:538
                                                                                                                                            • /bin/bash
                                                                                                                                              sh -c "sysctl -n hw.ncpu"
                                                                                                                                              2⤵
                                                                                                                                                PID:538
                                                                                                                                              • /usr/sbin/sysctl
                                                                                                                                                sysctl -n hw.ncpu
                                                                                                                                                2⤵
                                                                                                                                                  PID:538
                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                xpcproxy afsvcpd
                                                                                                                                                1⤵
                                                                                                                                                  PID:539
                                                                                                                                                • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                  /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                  1⤵
                                                                                                                                                    PID:539
                                                                                                                                                    • /bin/sh
                                                                                                                                                      sh -c "sysctl -n hw.ncpu"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:540
                                                                                                                                                      • /bin/bash
                                                                                                                                                        sh -c "sysctl -n hw.ncpu"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:540
                                                                                                                                                        • /usr/sbin/sysctl
                                                                                                                                                          sysctl -n hw.ncpu
                                                                                                                                                          2⤵
                                                                                                                                                            PID:540
                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                          xpcproxy afsvcpd
                                                                                                                                                          1⤵
                                                                                                                                                            PID:541
                                                                                                                                                          • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                            /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                            1⤵
                                                                                                                                                              PID:541
                                                                                                                                                              • /bin/sh
                                                                                                                                                                sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:542
                                                                                                                                                                • /bin/bash
                                                                                                                                                                  sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:542
                                                                                                                                                                  • /usr/sbin/sysctl
                                                                                                                                                                    sysctl -n hw.ncpu
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:542
                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                    xpcproxy afsvcpd
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:543
                                                                                                                                                                    • /Users/run/Library/osxmobiledata/com.apple.afsvcpd
                                                                                                                                                                      /Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:543
                                                                                                                                                                        • /bin/sh
                                                                                                                                                                          sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:544
                                                                                                                                                                          • /bin/bash
                                                                                                                                                                            sh -c "sysctl -n hw.ncpu"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:544
                                                                                                                                                                            • /usr/sbin/sysctl
                                                                                                                                                                              sysctl -n hw.ncpu
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:544

                                                                                                                                                                            Network

                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                  Downloads