Play interactive tour
Edit tourAnalysis Report lSrIxJfe79
Overview
General Information
| Sample Name: | lSrIxJfe79 |
| Analysis ID: | 1304602 |
| MD5: | ecffbd1687bacaf5f766c92097435f14 |
| SHA1: | c2e0b35fd4f24e9e98319e10c6f2f803b01ec3f1 |
| SHA256: | cfa3d506361920f9e1db9d8324dfbb3a9c79723e702d70c3dc8f51825c171420 |
Most interesting Screenshot:  | |
Detection
OceanLotus
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
Signatures
Detected macOS OceanLotus
Removes the quarantine attribute (used to protect from malware) from files
Yara detected OceanLotus
App bundle contains hidden files/directories
Executes the "ifconfig" command used to gather network information
Executes the "ioreg" command used to gather hardware information (I/O kit registry)
Explicitly modifies time stamps using the "touch" command
Likely queries the I/O Kit registry to detect VMs (based on "IOPlatformExpertDevice" class)
Process deletes its process image on disk
Process executable has an extension which is uncommon (probably to disguise the executable)
Process path indicates hidden application bundle (probably to disguise it)
Queries the unique Apple serial number of the machine
Searches for specific files/directories within the "Users" directory
Terminates several processes with shell command 'killall'
Writes Mach-O files to untypical directories
Changes permissions of written Mach-O files
Creates 'launchd' managed services aka launch agents with bundle ID names to possibly disguise malicious intentions
Creates memory-persistent launch services
Creates user-wide 'launchd' managed services aka launch agents
Deletes icon files
Executes commands using a shell command-line interpreter
Executes the "base64" command used to encode or decode data (e.g. files, payloads)
Executes the "chmod" command used to modify permissions
Executes the "find" command together with an exec argument (might be indicative for ransomware)
Executes the "rm" command used to delete files or directories
Executes the "sleep" command used to delay execution and potentially evade sandboxes
Executes the "system_profiler" command used to collect detailed system hardware and software information
Executes the "touch" command used to create files or modify time stamps
Executes the "uname" command used to read OS and architecture name
Explicitly loads/starts launch services
Explicitly unloads, stops, and/or removes launch services
Hides files and/or directories from GUI
Many shell processes execute programs via execve syscall (might be indicative for malicious behavior)
Queries OS software version with shell command 'sw_vers'
Reads hardware related sysctl values
Reads launchservices plist files
Reads the sysctl hardware model value (might be used for detecting VM presence)
Reads the systems OS release and/or type
Reads the systems hostname
Reads, modifies and/or removes extended attributes containing macOS specific file meta data
Sample tries to kill a process (SIGKILL)
Writes FAT Mach-O files to disk
Writes ZIP files to disk
Classification
×
Startup |
|---|
|