nikolay-n

import React, { useEffect, useState } from "react";
import { Provider, useSelector, useDispatch } from "react-redux";
import { Store } from "redux";
import { HashRouter as Router } from "react-router-dom";
import { NftMetadataProvider } from "@ledgerhq/live-common/nft/NftMetadataProvider/index";
import "./global.css";
import "tippy.js/dist/tippy.css";
import "tippy.js/animations/shift-away.css";
import "tippy.js/animations/shift-toward.css";
import "tippy.js/dist/svg-arrow.css";

nikolay-n

$dump = `launchctl dumpstate`;
%services = ();
%endpoints = ();
$service = "";
$current_service = "";
$endpoints_block = 0;
for(split("\n", $dump)){
    $service = $1 if /^([^\s]+)\s=/;
    if ($service and ($service ne $current_service)){ 
        $current_service = $service;

nikolay-n

private rule MachO
{
     meta:
        description = "Mach-O executable"
        category = "macho"
    
     condition:
        (uint32(0) == 0xfeedface    or uint32(0) == 0xcafebabe
        or uint32(0) == 0xbebafeca  or uint32(0) == 0xcefaedfe
        or uint32(0) == 0xfeedfacf  or uint32(0) == 0xcffaedfe)

nikolay-n

#!/usr/bin/env python
from __future__ import print_function
import os
import subprocess
import threading
import json

# ProcessMonitor need to download from https://objective-see.com/products/utilities.html 
# and put to /Applications/ folder
# also give Terminal.app Full Disk Access

nikolay-n

ACTIVITY_LOG_STDERR
AEConvertBookmarksToAliasesHack
AEDebugFull
AEDebugReceives
AEDebugSends
ALLOWED_GPU_IDS
APPLE_FRAMEWORKS_ROOT
ARCH
ASL_DISABLE
ASL_QUOTA_DISABLED

nikolay-n

# just include this file in ~/.bash_profile or ~/.zprofile
# . ~/.bash_aliases

# displays codesign entitlements, requires jq for json syntax highlighting (brew install jq)
# example: ents /usr/libexec/sandboxd
alias ents='ents_f(){ codesign -d --entitlements :- "$1" 2>/dev/null | plutil -convert json -o - - | jq .; }; ents_f'

# removes quarantine flag recursively
# example: qr ~/Downloads/some_file_or_dir
alias qr='xattr -r -d com.apple.quarantine'

nikolay-n

aadf0cf72fc2f4a83cea60c07d4b38c9f17cfab6ab2748c3cafad0b7424a877d
748526e8f98eeb6b60833e6dd3b8c9d5b0a0245bb527174434f8875f39fd83a2
9f2fc440b0bb827b127c9a0d5f44864583a28eb376ce413dbe2d387c7075c4fe
f02fee923c57bb228a5fb065aac126ff69dba8363d8d73e70f75dff3a7c4973d
238247ad80220a8436636358b58c0cc173d6a1950726a738b680c4980630084d
a1ea93cb6f1b4f95a50a241d69261a2c9d783f7e36f772297c1f5cfda485696f
6621d72c4f468bc7d77e8206cb3e06966ee0aa9eaec5467326bb0d53ad539f3c

nikolay-n

Prefix	Framework
AB	AddressBook / AddressBookUI
AC	Accounts
AD	iAd
AK	AuthKit
AL	AssetsLibrary
AM	Automator
AU	AudioUnit
AV	AVFoundation

nikolay-n

#!/usr/bin/env bash

exec 3>&2
trap 'exec 2>>/dev/null' DEBUG
exec 2>&3

for pkg in $(mdfind "kMDItemContentTypeTree=public.archive" | grep -E "\.pkg$" | sort | uniq)
do
    if [[ -f "$pkg" ]]
    then

nikolay-n

| Rule ID | Malware Name | Add | Mod | Virustotal | Hybrid Analysis | ObjSee