Overview

overview

8

Static

static

1

VanishRaider

macos-10.15-amd64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VanishRaider

  • Size

    303KB

  • Sample

    240703-12razsybkl

  • MD5

    f7d7db4761fd35be02a830a95171d620

  • SHA1

    7a8ff7ce77c5403fae478f4cce478ae76326224f

  • SHA256

    488e77d98f25ced9fb17a11a29ddb97e8e2b7af76eaf4c045c78b314390528df

  • SHA512

    27974036f807465ea808fdf316aa4e3eeda6bf8e23c74ccdb27c5a1c8ec802c511d13c67a1ed8ce387109d4f677b8227562388740cc866706b227793deccb2f8

  • SSDEEP

    6144:k+o0r2n9dH5M2vkm0y3Cl3pId9Rj9dvZJT3CqbMrhryfQNRPaCieMjAkvCJv1ViZ:po0r2n9dH5M2vkm0y3Cl3pId9Rj9dvZl

Score
8/10
discoveryevasionmacos

Malware Config

Targets

    • Target

      VanishRaider

    • Size

      303KB

    • MD5

      f7d7db4761fd35be02a830a95171d620

    • SHA1

      7a8ff7ce77c5403fae478f4cce478ae76326224f

    • SHA256

      488e77d98f25ced9fb17a11a29ddb97e8e2b7af76eaf4c045c78b314390528df

    • SHA512

      27974036f807465ea808fdf316aa4e3eeda6bf8e23c74ccdb27c5a1c8ec802c511d13c67a1ed8ce387109d4f677b8227562388740cc866706b227793deccb2f8

    • SSDEEP

      6144:k+o0r2n9dH5M2vkm0y3Cl3pId9Rj9dvZJT3CqbMrhryfQNRPaCieMjAkvCJv1ViZ:po0r2n9dH5M2vkm0y3Cl3pId9Rj9dvZl

    Score
    8/10
    discoveryevasion

    • Path Permission

      Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.

      evasion

    • Gatekeeper Bypass

      Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.

      evasion

    • File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.

      evasion
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1
T1222

Linux and Mac File and Directory Permissions Modification

1
T1222.002

Subvert Trust Controls

1
T1553

Gatekeeper Bypass

1
T1553.001

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Hide Artifacts

1
T1564

Resource Forking

1
T1564.009

Credential Access

Discovery

File and Directory Discovery

1
T1083

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks