Edit tour

macOS Analysis Report
V6QED2Q1WBYVOPE

Overview

General Information

Sample name:	V6QED2Q1WBYVOPE
Analysis ID:	1558654
MD5:	6dee3bbd2bb0b9de6423700a8e1fe1e8
SHA1:	88537c509c075956ba5d4e1d9fbdd18eaa357e53
SHA256:	1001c1ed209abec59d96e0f27007561c3036c585dd0113ed3cc074bf6a11c105
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Mach-O contains sections with high entropy indicating compressed/encrypted content

Sample or dropped file has a small TEXT segment size indicating that the actual code is not in this segment hampering debugging

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558654
Start date and time:	2024-11-19 17:03:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Sample name:	V6QED2Q1WBYVOPE
Detection:	MAL
Classification:	mal56.mac@0/0@1/0

Warnings

Excluded IPs from analysis (whitelisted): 17.253.97.205, 17.253.97.201, 17.36.200.79, 17.253.27.196, 17.253.27.204, 17.253.3.198, 23.58.90.40
Excluded domains from analysis (whitelisted): lcdn-locator-usuqo.apple.com.akadns.net, updates.cdn-apple.com.akadns.net, e673.dsce9.akamaiedge.net, crl.apple.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, lcdn-locator.apple.com.akadns.net, lcdn-locator.apple.com, mesu.g.aaplimg.com, updates.g.aaplimg.com, itunes.apple.com.edgekey.net, init.itunes.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net
VT rate limit hit for: V6QED2Q1WBYVOPE

Runtime Messages

Command:	/Users/bernard/Desktop/V6QED2Q1WBYVOPE
PID:	620
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

System is macvm-mojave

mono-sgen32 New Fork (PID: 620, Parent: 537)

V6QED2Q1WBYVOPE (MD5: 6dee3bbd2bb0b9de6423700a8e1fe1e8) Arguments: /Users/bernard/Desktop/V6QED2Q1WBYVOPE

xpcproxy New Fork (PID: 639, Parent: 1)

eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: V6QED2Q1WBYVOPE

Avira: detected

Multi AV Scanner detection for submitted file

Source: V6QED2Q1WBYVOPE

ReversingLabs: Detection: 50%

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49381 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49382 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49385 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49397 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.144.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.48.144.29
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.93.152
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.93.152
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.93.152
Source: unknown	TCP traffic detected without corresponding DNS query: 23.195.93.152
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: V6QED2Q1WBYVOPE, 00000620.00000249.9.0000000115fcd000.0000000115ff6000.r--.sdmp	String found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: V6QED2Q1WBYVOPE, 00000620.00000249.9.0000000115fcd000.0000000115ff6000.r--.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: V6QED2Q1WBYVOPE, 00000620.00000249.9.0000000115fcd000.0000000115ff6000.r--.sdmp	String found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: V6QED2Q1WBYVOPE, 00000620.00000249.9.0000000115fcd000.0000000115ff6000.r--.sdmp	String found in binary or memory: http://www.apple.com/certificateauthority0
Source: V6QED2Q1WBYVOPE, 00000620.00000249.9.0000000115fcd000.0000000115ff6000.r--.sdmp	String found in binary or memory: https://www.apple.com/appleca/0

Source: unknown	Network traffic detected: HTTP traffic on port 49397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49383
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49382
Source: unknown	Network traffic detected: HTTP traffic on port 49395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49381
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49395
Source: unknown	Network traffic detected: HTTP traffic on port 49394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49394
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49390
Source: unknown	Network traffic detected: HTTP traffic on port 49390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49381 -> 443

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49381 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49382 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49385 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49390 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49397 version: TLS 1.2

Source: classification engine

Classification label: mal56.mac@0/0@1/0

Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 639)

Random device file read: /dev/random

Jump to behavior

Source: V6QED2Q1WBYVOPE

Submission file: section __data with 7.99957854 entropy (max. 8.0)

Source: V6QED2Q1WBYVOPE

Mach-O __TEXT segment size: 0x1000 <= 16 KB

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Obfuscated Files or Information	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
V6QED2Q1WBYVOPE	100%	Avira	OSX/GM.Agent.MB
V6QED2Q1WBYVOPE	50%	ReversingLabs	MacOS.Dropper.SAgnt

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
h3.apis.apple.map.fastly.net	151.101.131.6	true	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.131.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false
23.48.144.29	unknown	United States	20940	AKAMAI-ASN1EU	false
23.195.93.152	unknown	United States	16625	AKAMAI-ASUS	false
151.101.67.6	unknown	United States	54113	FASTLYUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
151.101.131.6	https://henrybodmerabeggco.wordpress.com/abegg-co-ag-proposal/	Get hash	malicious	Unknown	Browse
	CalendlyApp	Get hash	malicious	Unknown	Browse
	https://burlingtonenqlish.com/vm%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	Unknown	Browse
	Constate	Get hash	malicious	Unknown	Browse
	https://topawardpicks.top	Get hash	malicious	Unknown	Browse
	https://b3dc9.dynv6.net/en-tj/iphone	Get hash	malicious	Unknown	Browse
	https://b3dc9.dynv6.net/en-uz/mac	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3D	Get hash	malicious	Unknown	Browse
	http://grifon.info/announce?info_hash=%08%95%AE%D1m%DD%1A%0B%CEo%C0%27%3Af%7B%14sf%3FC&peer_id=-AZ5770-SNhwkI5WcC8E&supportcrypto=1&port=51797&azudp=51797&uploaded=0&downloaded=0&left=243670495&corrupt=0&event=started&numwant=75&no_peer_id=1&compact=1&key=j9C8cT74&azver=3(87.236.16.208)	Get hash	malicious	Unknown	Browse
23.48.144.29	https://cdnperf-test.innertest.top/500b-bench.jpg	Get hash	malicious	Unknown	Browse
23.48.144.29	http://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7306521088920387799&website=21505-85fb5adz&placement=21505	Get hash	malicious	Unknown	Browse
151.101.67.6	CalendlyApp	Get hash	malicious	Unknown	Browse
	Constate	Get hash	malicious	Unknown	Browse
	iB8UZgdjgk	Get hash	malicious	CTHULHU STEALER	Browse
	sakura	Get hash	malicious	Unknown	Browse
	GlobalProtect-6.3.1.pkg	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==	Get hash	malicious	Unknown	Browse
	https://topawardpicks.top	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3D	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
h3.apis.apple.map.fastly.net	https://henrybodmerabeggco.wordpress.com/abegg-co-ag-proposal/	Get hash	malicious	Unknown	Browse	151.101.195.6
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse	151.101.3.6
	CalendlyApp	Get hash	malicious	Unknown	Browse	151.101.131.6
	CalendlyApp	Get hash	malicious	Unknown	Browse	151.101.195.6
	Constate	Get hash	malicious	Unknown	Browse	151.101.67.6
	iB8UZgdjgk	Get hash	malicious	CTHULHU STEALER	Browse	151.101.67.6
	sakura	Get hash	malicious	Unknown	Browse	151.101.3.6
	GlobalProtect-6.3.1.pkg	Get hash	malicious	Unknown	Browse	151.101.195.6

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	2.19.126.160
	phish_alert_sp2_2.0.0.0 (7).eml	Get hash	malicious	Unknown	Browse	2.19.126.160
	https://fixedzip.oss-ap-southeast-5.aliyuncs.com/replace.txt	Get hash	malicious	Unknown	Browse	184.28.90.27
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.210.122.61
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.199.218.33
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.192.223.232
	Reminder_ Modifications to Employee Benefits Scheme & Salary Enhancement for Approval.pdf.eml	Get hash	malicious	Unknown	Browse	2.19.126.136
	Play audio message wav from Ann & Cory Ellis (Work).pdf	Get hash	malicious	Unknown	Browse	173.223.200.143
	owari.x86.elf	Get hash	malicious	Unknown	Browse	104.78.21.152
FASTLYUS	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	151.101.66.49
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
FASTLYUS	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	f5dc5302-022c-8bef-7a8e-e20ea821f59b.eml	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.1.91
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.65.91
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	151.101.66.49
	file.exe	Get hash	malicious	Credential Flusher	Browse	151.101.193.91
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	23.44.203.15
	jO7FHDAZ6f.pdf	Get hash	malicious	Unknown	Browse	172.232.4.213
	SP3IUr6MfJ.exe	Get hash	malicious	AsyncRAT	Browse	172.233.187.199
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.206.195.168
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.221.22.214
	https://website-70396.convertflowpages.com/firstmarkinsurance	Get hash	malicious	HTMLPhisher	Browse	172.233.61.221
	owari.sh4.elf	Get hash	malicious	Unknown	Browse	172.232.16.214
	owari.mpsl.elf	Get hash	malicious	Unknown	Browse	104.85.26.118
	owari.ppc.elf	Get hash	malicious	Unknown	Browse	172.237.240.232
	Portfolio Review _2024.html	Get hash	malicious	Unknown	Browse	2.19.97.184

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5c118da645babe52f060d0754256a73c	CalendlyApp	Get hash	malicious	Unknown	Browse	151.101.131.6 151.101.67.6
	CalendlyApp	Get hash	malicious	Unknown	Browse	151.101.131.6 151.101.67.6
	https://burlingtonenqlish.com/vm%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	Unknown	Browse	151.101.131.6 151.101.67.6
	Constate	Get hash	malicious	Unknown	Browse	151.101.131.6 151.101.67.6
	iB8UZgdjgk	Get hash	malicious	CTHULHU STEALER	Browse	151.101.131.6 151.101.67.6
	sakura	Get hash	malicious	Unknown	Browse	151.101.131.6 151.101.67.6
	GlobalProtect-6.3.1.pkg	Get hash	malicious	Unknown	Browse	151.101.131.6 151.101.67.6
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==	Get hash	malicious	Unknown	Browse	151.101.131.6 151.101.67.6

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|PIE>
Entropy (8bit):	7.999550458092694
TrID:	Mac OS X Mach-O 64-bit Intel executable (4008/2) 50.02% Mac OS X Mach-O 64-bit executable (little-endian) (4004/1) 49.98%
File name:	V6QED2Q1WBYVOPE
File size:	9'507'924 bytes
MD5:	6dee3bbd2bb0b9de6423700a8e1fe1e8
SHA1:	88537c509c075956ba5d4e1d9fbdd18eaa357e53
SHA256:	1001c1ed209abec59d96e0f27007561c3036c585dd0113ed3cc074bf6a11c105
SHA512:	0f6c7ebb1ae128eba6d1350058f00c026ad58f8d6a4c580fa73cf9eb9b8147581fca957894d4a1c4b1a6f5eb6c2d3264ad155f08551e895f405d5952839b8be7
SSDEEP:	196608:n5v0ZL3vCmgUTRDB397K0AHJuOML1SinMHc85tSygFHQy9VRnQI:nR09sUTb97plOMLTMHc4tPQFPRQI
TLSH:	18A6334DE6B32C36F6656274B07E789CB848671E65A1B2E9B0C4F7CD2C40D62C7782C6
File Content Preview:	.......................... .........H...__PAGEZERO..........................................................(...__TEXT..........................................................__text..........__TEXT..................*......................................

Static Mach Info

General Information for header 1
Endian:	little-endian
Size:	64-bit
Architecture:	x86_64
Filetype:	execute
Nbr. of load commands:	16
Entry point:	0x1000008E0

segment_64 load command - aggregated: 4

Name	Value
segname	__PAGEZERO
vmaddr	0x0
vmsize	0x100000000
fileoff	0x0
filesize	0x0
maxprot	0x0
initprot	0x0
nsects	0
flags	0x0

Name

Value

segname

__TEXT

vmaddr

0x100000000

vmsize

0x1000

fileoff

0x0

filesize

0x1000

maxprot

0x7

initprot

0x5

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__text	__TEXT	0x100000880	0x62A	0x880	5.08383778	4	0x0	0	0x80000400
__stubs	__TEXT	0x100000EAA	0x4E	0xEAA	2.86836912	1	0x0	0	0x80000400
__stub_helper	__TEXT	0x100000EF8	0x92	0xEF8	3.35268794	2	0x0	0	0x80000400
__cstring	__TEXT	0x100000F8A	0x12	0xF8A	2.97493750	0	0x0	0	0x0
__unwind_info	__TEXT	0x100000F9C	0x48	0xF9C	1.61056806	2	0x0	0	0x0
__eh_frame	__TEXT	0x100000FE8	0x18	0xFE8	2.78415913	3	0x0	0	0x0

Name

Value

segname

__DATA

vmaddr

0x100001000

vmsize

0x910000

fileoff

0x1000

filesize

0x910000

maxprot

0x7

initprot

0x3

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__nl_symbol_ptr	__DATA	0x100001000	0x10	0x1000	-0.00000000	3	0x0	0	0x0
__got	__DATA	0x100001010	0x8	0x1010	-0.00000000	3	0x0	0	0x0
__la_symbol_ptr	__DATA	0x100001018	0x68	0x1018	2.01134991	3	0x0	0	0x0
__data	__DATA	0x100001080	0x90F484	0x1080	7.99957854	4	0x0	0	0x0

Name	Value
segname	__LINKEDIT
vmaddr	0x100911000
vmsize	0x1000
fileoff	0x911000
filesize	0x454
maxprot	0x7
initprot	0x1
nsects	0
flags	0x0

dyld_info_only load command - aggregated: 1

Name	Value
rebase_off	9506816
rebase_size	8
bind_off	9506824
bind_size	56
weak_bind_off	0
weak_bind_size	0
lazy_bind_off	9506880
lazy_bind_size	224
export_off	9507104
export_size	80

symtab load command - aggregated: 1

Name	Value
symoff	9507256
nsyms	20
stroff	9507692
strsize	232

dysymtab load command - aggregated: 1

Name	Value
ilocalsym	0
nlocalsym	0
iextdefsym	0
nextdefsym	5
iundefsym	5
nundefsym	15
tocoff	0
ntoc	0
modtaboff	0
nmodtab	0
extrefsymoff	0
nextrefsyms	0
indirectsymoff	9507576
nindirectsyms	29
extreloff	0
nextrel	0
locreloff	0
nlocrel	0

load_dylinker load command - aggregated: 1

Name	Value

uuid load command - aggregated: 1

Name	Value
uuid	331b5ea8-e511-3977-b94a-1f7cc89c9c13

version_min_macosx load command - aggregated: 1

Name	Value
version	10.9.0
sdk	10.9.0

source_version load command - aggregated: 1

Name	Value
path	0.0.0.0.0

main load command - aggregated: 1

Name	Value

load_dylib load command - aggregated: 1

Name

Value

compatibility_version

1.0.0

current_version

1197.1.1

timestamp

1970-01-01

Datas

/usr/lib/libSystem.B.dylib

function_starts load command - aggregated: 1

Name	Value
dataoff	9507184
datasize	8

data_in_code load command - aggregated: 1

Name	Value
dataoff	9507192
datasize	0

dylib_code_sign_drs load command - aggregated: 1

Name	Value
dataoff	9507192
datasize	9507192

Symbols

Name	Category	Origin	Segment Name	Bind Address	Library Name
__mh_execute_header	EXTERNAL	LC_SYMTAB
_bytes	EXTERNAL	LC_SYMTAB
_key	EXTERNAL	LC_SYMTAB
_main	EXTERNAL	LC_SYMTAB
_strpos	EXTERNAL	LC_SYMTAB
__NSGetExecutablePath	UNDEFINED	LC_SYMTAB	__DATA	0x100001018	/usr/lib/libSystem.B.dylib
___memset_chk	UNDEFINED	LC_SYMTAB	__DATA	0x100001020	/usr/lib/libSystem.B.dylib
___sprintf_chk	UNDEFINED	LC_SYMTAB	__DATA	0x100001028	/usr/lib/libSystem.B.dylib
___stack_chk_fail	UNDEFINED	LC_SYMTAB	__DATA	0x100001030	/usr/lib/libSystem.B.dylib
___stack_chk_guard	UNDEFINED	LC_SYMTAB	__DATA	0x100001010	/usr/lib/libSystem.B.dylib
___strcat_chk	UNDEFINED	LC_SYMTAB	__DATA	0x100001038	/usr/lib/libSystem.B.dylib
_fclose	UNDEFINED	LC_SYMTAB	__DATA	0x100001040	/usr/lib/libSystem.B.dylib
_fopen	UNDEFINED	LC_SYMTAB	__DATA	0x100001048	/usr/lib/libSystem.B.dylib
_fwrite	UNDEFINED	LC_SYMTAB	__DATA	0x100001050	/usr/lib/libSystem.B.dylib
_malloc	UNDEFINED	LC_SYMTAB	__DATA	0x100001058	/usr/lib/libSystem.B.dylib
_memset	UNDEFINED	LC_SYMTAB	__DATA	0x100001060	/usr/lib/libSystem.B.dylib
_strlen	UNDEFINED	LC_SYMTAB	__DATA	0x100001068	/usr/lib/libSystem.B.dylib
_strstr	UNDEFINED	LC_SYMTAB	__DATA	0x100001070	/usr/lib/libSystem.B.dylib
_system	UNDEFINED	LC_SYMTAB	__DATA	0x100001078	/usr/lib/libSystem.B.dylib
dyld_stub_binder	UNDEFINED	LC_SYMTAB	__DATA	0x100001000	/usr/lib/libSystem.B.dylib

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 17:04:39.983302116 CET	49381	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:39.983345985 CET	443	49381	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:39.983994007 CET	49381	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:39.984745026 CET	49381	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:39.984759092 CET	443	49381	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.181462049 CET	443	49381	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.182219028 CET	49381	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.182586908 CET	49381	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.207413912 CET	49381	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.207528114 CET	443	49381	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.207669020 CET	443	49381	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.208230972 CET	49381	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.208230972 CET	49381	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.239852905 CET	49382	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.239900112 CET	443	49382	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.240586042 CET	49382	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.241601944 CET	49382	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.241616011 CET	443	49382	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.437441111 CET	443	49382	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.439269066 CET	49382	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.439269066 CET	49382	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.446038961 CET	49382	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.446100950 CET	443	49382	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.446192026 CET	443	49382	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.446794987 CET	49382	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.446794987 CET	49382	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.463907003 CET	49383	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.463952065 CET	443	49383	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.464611053 CET	49383	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.465437889 CET	49383	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.465471983 CET	443	49383	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.659374952 CET	443	49383	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.661350965 CET	49383	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.661350965 CET	49383	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.667638063 CET	49383	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.667746067 CET	443	49383	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.667886019 CET	443	49383	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.668436050 CET	49383	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.668654919 CET	49383	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.679480076 CET	49384	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.679523945 CET	443	49384	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.680120945 CET	49384	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.681075096 CET	49384	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.681109905 CET	443	49384	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.881270885 CET	443	49384	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.882145882 CET	49384	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.882145882 CET	49384	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.887540102 CET	49384	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.887768984 CET	443	49384	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.888248920 CET	443	49384	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:40.888402939 CET	49384	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:40.888695002 CET	49384	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.526765108 CET	49385	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.526876926 CET	443	49385	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:41.527611971 CET	49385	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.528840065 CET	49385	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.528901100 CET	443	49385	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:41.731548071 CET	443	49385	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:41.732285976 CET	49385	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.732445955 CET	49385	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.764358997 CET	49385	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.764611959 CET	443	49385	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:41.765049934 CET	443	49385	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:41.765208006 CET	49385	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.765505075 CET	49385	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.824763060 CET	49386	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.824879885 CET	443	49386	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:41.825484037 CET	49386	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.826282978 CET	49386	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:41.826343060 CET	443	49386	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:42.029242992 CET	443	49386	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:42.030265093 CET	49386	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:42.030325890 CET	49386	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:42.039565086 CET	49386	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:42.039820910 CET	443	49386	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:42.040277958 CET	443	49386	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:42.040381908 CET	49386	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:42.040849924 CET	49386	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:42.894253016 CET	49390	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:42.894376040 CET	443	49390	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:42.895073891 CET	49390	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:42.895869017 CET	49390	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:42.895931005 CET	443	49390	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:43.090893030 CET	443	49390	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:43.091991901 CET	49390	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:43.092138052 CET	49390	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:43.133562088 CET	49390	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:43.133666992 CET	443	49390	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:43.133805037 CET	443	49390	151.101.67.6	192.168.11.12
Nov 19, 2024 17:04:43.134464025 CET	49390	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:04:43.134485006 CET	49390	443	192.168.11.12	151.101.67.6
Nov 19, 2024 17:05:04.818169117 CET	49347	80	192.168.11.12	23.48.144.29
Nov 19, 2024 17:05:04.953430891 CET	80	49347	23.48.144.29	192.168.11.12
Nov 19, 2024 17:05:04.975131989 CET	80	49347	23.48.144.29	192.168.11.12
Nov 19, 2024 17:05:04.975723982 CET	49347	80	192.168.11.12	23.48.144.29
Nov 19, 2024 17:05:09.134529114 CET	49353	443	192.168.11.12	23.195.93.152
Nov 19, 2024 17:05:09.136161089 CET	49353	443	192.168.11.12	23.195.93.152
Nov 19, 2024 17:05:09.250516891 CET	443	49353	23.195.93.152	192.168.11.12
Nov 19, 2024 17:05:09.250530958 CET	443	49353	23.195.93.152	192.168.11.12
Nov 19, 2024 17:05:09.252394915 CET	49353	443	192.168.11.12	23.195.93.152
Nov 19, 2024 17:05:09.252394915 CET	49353	443	192.168.11.12	23.195.93.152
Nov 19, 2024 17:06:10.590363979 CET	49394	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.590418100 CET	443	49394	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:10.591047049 CET	49394	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.591871977 CET	49394	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.591897964 CET	443	49394	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:10.786360979 CET	443	49394	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:10.787170887 CET	49394	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.787193060 CET	49394	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.794425011 CET	49394	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.794500113 CET	443	49394	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:10.794631004 CET	443	49394	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:10.795140982 CET	49394	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.795165062 CET	49394	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.811619043 CET	49395	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.811674118 CET	443	49395	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:10.812325954 CET	49395	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.813126087 CET	49395	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:10.813146114 CET	443	49395	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.007011890 CET	443	49395	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.007785082 CET	49395	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.007931948 CET	49395	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.012516022 CET	49395	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.012590885 CET	443	49395	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.012723923 CET	443	49395	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.013242006 CET	49395	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.013326883 CET	49395	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.040772915 CET	49396	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.040828943 CET	443	49396	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.041523933 CET	49396	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.042443037 CET	49396	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.042486906 CET	443	49396	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.237250090 CET	443	49396	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.237991095 CET	49396	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.238013983 CET	49396	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.243618965 CET	49396	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.243695021 CET	443	49396	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.243828058 CET	443	49396	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.244362116 CET	49396	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.244389057 CET	49396	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.258131981 CET	49397	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.258192062 CET	443	49397	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.259218931 CET	49397	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.260046005 CET	49397	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.260071993 CET	443	49397	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.453663111 CET	443	49397	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.454425097 CET	49397	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.454514027 CET	49397	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.460832119 CET	49397	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.460903883 CET	443	49397	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.461041927 CET	443	49397	151.101.131.6	192.168.11.12
Nov 19, 2024 17:06:11.461571932 CET	49397	443	192.168.11.12	151.101.131.6
Nov 19, 2024 17:06:11.461663961 CET	49397	443	192.168.11.12	151.101.131.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 19, 2024 17:04:28.405605078 CET	53	52458	1.1.1.1	192.168.11.12
Nov 19, 2024 17:06:10.492904902 CET	63909	53	192.168.11.12	1.1.1.1
Nov 19, 2024 17:06:10.588174105 CET	53	63909	1.1.1.1	192.168.11.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 19, 2024 17:06:10.492904902 CET	192.168.11.12	1.1.1.1	0x362e	Standard query (0)	h3.apis.apple.map.fastly.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 19, 2024 17:06:10.588174105 CET	1.1.1.1	192.168.11.12	0x362e	No error (0)	h3.apis.apple.map.fastly.net	151.101.131.6	A (IP address)	IN (0x0001)	false
Nov 19, 2024 17:06:10.588174105 CET	1.1.1.1	192.168.11.12	0x362e	No error (0)	h3.apis.apple.map.fastly.net	151.101.67.6	A (IP address)	IN (0x0001)	false
Nov 19, 2024 17:06:10.588174105 CET	1.1.1.1	192.168.11.12	0x362e	No error (0)	h3.apis.apple.map.fastly.net	151.101.3.6	A (IP address)	IN (0x0001)	false
Nov 19, 2024 17:06:10.588174105 CET	1.1.1.1	192.168.11.12	0x362e	No error (0)	h3.apis.apple.map.fastly.net	151.101.195.6	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: mono-sgen32 PID: 620, Parent PID: 537

General

Start time (UTC):	16:04:17
Start date (UTC):	19/11/2024
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Chronological Activities

Analysis Process: V6QED2Q1WBYVOPE PID: 620, Parent PID: 537

General

Start time (UTC):	16:04:17
Start date (UTC):	19/11/2024
Path:	/Users/bernard/Desktop/V6QED2Q1WBYVOPE
Arguments:	/Users/bernard/Desktop/V6QED2Q1WBYVOPE
File size:	9507924 bytes
MD5 hash:	6dee3bbd2bb0b9de6423700a8e1fe1e8

Chronological Activities

Analysis Process: xpcproxy PID: 639, Parent PID: 1

General

Start time (UTC):	16:04:48
Start date (UTC):	19/11/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Chronological Activities

Analysis Process: eficheck PID: 639, Parent PID: 1

General

Start time (UTC):	16:04:48
Start date (UTC):	19/11/2024
Path:	/usr/libexec/firmwarecheckers/eficheck/eficheck
Arguments:	/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
File size:	74048 bytes
MD5 hash:	328beb81a2263449258057506bb4987f

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report V6QED2Q1WBYVOPE

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static Mach Info

General Information for header 1

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: mono-sgen32 PID: 620, Parent PID: 537

General

Chronological Activities

Analysis Process: V6QED2Q1WBYVOPE PID: 620, Parent PID: 537

General

Chronological Activities

Analysis Process: xpcproxy PID: 639, Parent PID: 1

General

Chronological Activities

Analysis Process: eficheck PID: 639, Parent PID: 1

General

Chronological Activities

macOS Analysis Report
V6QED2Q1WBYVOPE