Analysis
- max time kernel
95s - max time network
134s - platform
macos-10.15_amd64 - resource
macos-20260915-en - resource tags
arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
02/11/2026, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd9
Resource
macos-20260915-en
0 signatures
150 seconds
General
- Target 705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd9
- Size 1.7MB
- Sample261102-le7bcsef66
- SHA256 705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd9
- MD5 dd3f8e4a304287d0c9871530f7bf722e
- SHA1 9e41d9925f5550870a312ceeced2cf3b4037f34b
- SHA512 84090b18cbacfa2952fcf029eefca78fa94051ec303774cb8e14b9652bdb50f8abdc8150a123eaeaae30e63bf76571a3b5e32bd316179933e242e2c1b9a91184
- SSDEEP 49152:4r27gXKPbZSEEuhCX2HYN5DqqdShDJDUIclqmsU/eoxA:c27c2SR5G4Ndqq4hdDUH5Q4A
- TLSH T16A8533AB3ADC4375DBC5457918A70AFAC657F33A7420839C706A94A218F3F9412FFA11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd9\""1⤵PID:470
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd9\""1⤵PID:470
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd91⤵PID:470
-
/bin/zsh/bin/zsh -c /Users/run/705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd92⤵PID:471
-
-
/Users/run/705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd9/Users/run/705d26d693bb2c5fbd1ee0bc422e9dcd9e12cb5dd5bb5b5bb7b45f413e15fbd92⤵PID:471
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:494
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:494
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.systemsoundserverd1⤵PID:495
-
/usr/sbin/systemsoundserverd/usr/sbin/systemsoundserverd1⤵PID:495
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵PID:496
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵PID:496
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵PID:504
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵PID:504