macOS Analysis Report
d1TtkSBl05.dmg

Overview

General Information

Sample name: d1TtkSBl05.dmg
(renamed file extension from none to dmg)
Original sample name: d1TtkSBl05
Analysis ID: 1539815
MD5: 67edf42ca4a72cf93b21f09d59736b81
SHA1: 7456c1284fb2865da6b2dda880d727dc53b9026c
SHA256: eea95fdafd0988bcac790cead96755dd973264e794246e4233c8dc8fa6486e7a
Infos:

Detection

Score: 2
Range: 0 - 100
Whitelisted: false

Signatures

Reads hardware related sysctl values
Reads the systems OS release and/or type
Reads the systems hostname
Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)

Classification

Source: unknown HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49381 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49382 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49385 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49390 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49391 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49392 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49393 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49399 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 23.46.224.247
Source: unknown TCP traffic detected without corresponding DNS query: 23.46.224.247
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /2021/mobileassets/041-40471/B96AF6E1-5FF6-4786-9956-944A1AFE086A/com_apple_MobileAsset_KextDenyList/404087a7302927411b6ea0e05114d2c68355185e.zip HTTP/1.1Host: updates.cdn-apple.comAccept: */*Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic HTTP traffic detected: GET /2024/patches/062-08173/234EE7F7-CC33-4CD3-85FC-60590A103560/com_apple_MobileAsset_CoreSuggestions/84f6102e2a09dd10dd694d795792a7771b6014fc.zip HTTP/1.1Host: updates.cdn-apple.comAccept: */*Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic HTTP traffic detected: GET /2024/patches/052-54451/D609556E-69B1-482E-9C33-B2E3510A1311/com_apple_MobileAsset_TimeZoneUpdate/c5a4d0df08e8faecf4faebbbadc4d96a07d9d990.zip HTTP/1.1Host: updates.cdn-apple.comAccept: */*Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net
Source: d1TtkSBl05.dmg String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: unknown Network traffic detected: HTTP traffic on port 49351 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49399 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49400
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49386
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49385
Source: unknown Network traffic detected: HTTP traffic on port 49393 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49383
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49382
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49381
Source: unknown Network traffic detected: HTTP traffic on port 49391 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49386 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49382 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49399
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown Network traffic detected: HTTP traffic on port 49394 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49394
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49393
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49392
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49391
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49390
Source: unknown Network traffic detected: HTTP traffic on port 49392 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49390 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49400 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49385 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49383 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49381 -> 443
Source: unknown HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49381 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49382 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49385 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49390 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49391 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49392 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49393 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49399 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: classification engine Classification label: clean2.macDMG@0/4@1/0
Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 674) Random device file read: /dev/random Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist Jump to behavior
Source: d1TtkSBl05.dmg Binary or memory string: 5EQEMUEY^ZR
Source: d1TtkSBl05.dmg Binary or memory string: (I@ZQEMUUMQZ
Source: d1TtkSBl05.dmg Binary or memory string: yQEmuUeue%x
Reads hardware related sysctl values
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) Sysctl read request: hw.cpu_freq (6.15) Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) Sysctl read request: hw.ncpu (6.3) Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) Sysctl read request: hw.memsize (6.24) Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) Sysctl read request: hw.availcpu (6.25) Jump to behavior
Reads the systems OS release and/or type
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) Sysctl requested: kern.ostype (1.1) Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) Sysctl requested: kern.osrelease (1.2) Jump to behavior
Reads the systems hostname
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) Sysctl requested: kern.hostname (1.10) Jump to behavior
Source: /usr/bin/open (PID: 638) System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 639) System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist Jump to behavior
cam-macmac-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
151.101.3.8
 appledownload.map.fastly.net United States
54113 FASTLYUS false
151.101.3.6
 h3.apis.apple.map.fastly.net United States
54113 FASTLYUS false
151.101.195.6
 unknown United States
54113 FASTLYUS false
23.46.224.247
 unknown United States
16625 AKAMAI-ASUS false
151.101.67.6
 unknown United States
54113 FASTLYUS false

Contacted Domains

Name IP Active
appledownload.map.fastly.net 151.101.3.8 true
h3.apis.apple.map.fastly.net 151.101.3.6 true