Play interactive tour

Edit tour

macOS Analysis Report http://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Overview

General Information

Sample URL:	http://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Analysis ID:	1114
Infos:
Most interesting Screenshot:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false

Signatures

Opens the Safari browser app

Writes JavaScript files to disk

Classification

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	1114
Start date:	11.08.2021
Start time:	19:40:55
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	urldownload.jbs
Sample URL:	http://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Analysis system description:	Virtual Machine, High Sierra (Office 2016 v16.16, Java 11.0.2+9, Adobe Reader 2019.010.20099)
Analysis Mode:	default
Detection:	CLEAN
Classification:	clean1.mac@0/7@1/0
Warnings:	Show All Excluded IPs from analysis (whitelisted): 18.156.205.85, 104.111.214.42, 93.184.220.29, 23.37.43.27, 17.253.55.202, 17.253.55.204, 17.253.55.206, 17.253.54.123, 17.253.34.251, 17.253.54.251, 17.253.54.253, 17.253.34.253 TCP Packets have been reduced to 100 Excluded domains from analysis (whitelisted): cdn.smoot.apple.com, time-macos.apple.com, time-osx.g.aaplimg.com, smoot-searchv2-euc1a.v.aaplimg.com, ocsp-a.g.aaplimg.com, gateway.icloud.com, g.symcd.com, e673.dsce9.akamaiedge.net, e8218.dscb1.akamaiedge.net, crl.apple.com, api.smoot.apple.com, bag-smoot.v.aaplimg.com, ocsp-ds.ws.symantec.com.edgekey.net, valid.apple.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, api-glb-euc1a.smoot.apple.com, configuration.apple.com, ocsp.apple.com, valid.origin-apple.com.akadns.net, cdn.smoot.g.aaplimg.com, ocsp.digicert.com, valid-apple.g.aaplimg.com, configuration.apple.com.akadns.net, configuration.apple.com.edgekey.net Report size getting too big, too many PREAD calls found.

Process Tree

System is macvm-highsierra

mono-sgen32 New Fork (PID: 552, Parent: 477)

curl (MD5: 078cd73f58d3d8f875eed22522ff73f7) Arguments:

xpcproxy New Fork (PID: 559, Parent: 1)

Safari (MD5: 8e18be737fe87f19fe7a97b4821e2005) Arguments: /Applications/Safari.app/Contents/MacOS/Safari

cleanup

Yara Overview

No yara matches

Jbx Signature Overview

• Compliance
• Networking
• System Summary
• Persistence and Installation Behavior
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 104.16.148.64:443 -> 192.168.11.11:49193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.145.100:443 -> 192.168.11.11:49199 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 104.76.200.212
Source: unknown	TCP traffic detected without corresponding DNS query: 104.76.200.212
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /scripttemplates/otSDKStub.js HTTP/1.1Host: cdn.cookielaw.orgUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15Accept: */*

Source: unknown

DNS traffic detected: queries for: cdn.cookielaw.org

Source: /usr/bin/curl (PID: 552)

Reads from socket in process: data

Source: .dat.nosync022f.Yka7fz.247.dr

String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443

Source: /usr/bin/curl (PID: 552)

Writes from socket in process: data

Source: unknown	HTTPS traffic detected: 104.16.148.64:443 -> 192.168.11.11:49193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.145.100:443 -> 192.168.11.11:49199 version: TLS 1.2

Source: classification engine

Classification label: clean1.mac@0/7@1/0

Source: /usr/libexec/xpcproxy (PID: 559)

Safari app opened: /Applications/Safari.app/Contents/MacOS/Safari

Source: /usr/bin/curl (PID: 552)

JavaScript file created: /Users/berri/Desktop/download/otSDKStub.js

Jump to dropped file

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 559)

Random device file read: /dev/urandom

Jump to behavior

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 559)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 559)	XML plist file created: /Users/berri/Library/Safari/.dat.nosync022f.Yka7fz	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 559)	Binary plist file created: /private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/0/SafariFamily/Safari/.dat.nosync022f.F2F7tx	Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 559)	Binary plist file created: /Users/berri/Library/Safari/.dat.nosync022f.PKWYac	Jump to dropped file

Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 559)

System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting1	Plist Modification1	Plist Modification1	Scripting1	OS Credential Dumping	System Information Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://cdn.cookielaw.org/scripttemplates/otSDKStub.js	0%	Virustotal		Browse
http://cdn.cookielaw.org/scripttemplates/otSDKStub.js	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
gateway.fe.apple-dns.net	0%	Virustotal		Browse

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gateway.fe.apple-dns.net	17.248.145.100	true	false	0%, Virustotal, Browse	unknown
cdn.cookielaw.org	104.16.148.64	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cdn.cookielaw.org/scripttemplates/otSDKStub.js	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.16.148.64	cdn.cookielaw.org	United States		13335	CLOUDFLARENETUS	false
104.76.200.212	unknown	United States		3462	HINETDataCommunicationBusinessGroupTW	false

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Runtime Messages

Command:	open "/Users/berri/Desktop/download/otSDKStub.js" --args
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Created / dropped Files

/Users/berri/Desktop/download/otSDKStub.js Download File
Process:	/usr/bin/curl
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	18980
Entropy (8bit):	5.3338374894840825
Encrypted:	false
SSDEEP:	192:QQp/7PwSgaX8swswcTa2VFQbcMreCsMFHRymXUxcjHVYRVOgzwwGBaJ+7iIKBw:DRrFsBsfTaiBMFHRy0V2VuwG4J+uIKBw
MD5:	F180AA7CC67F34C65ED943EA4FD2164D
SHA1:	A8A64EE6DE4F8335AF2F45FC2C1B982AC3ACE64F
SHA-256:	0E45F3B0DAD8AA0528790A6DD6DD2831BB8547129BD1320C10FD120118F44616
SHA-512:	0DD6374860B3BF808F4B93B1D7EFE47E65315EA2D6BC1C778A6804F11CB30A14F0A753D7D68D460324F797818553895883C5C0EB88EC6C4B89777FA736D6B8DD
Malicious:	false
Reputation:	low
Preview:	var OneTrustStub=function(e){"use strict";var t,o,n,i,a,r,s,l,c,p,u,d,m,h,f,g,b,A,y,v,C,I,w,S,T,L,R,B,D,P,_,E,G,U,O,k,F,V,N,x,j,H,M,K,z,q,J,W,Y,Q,X,Z,$,ee=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}};(o=t=t\|\|{})[o.Unknown=0]="Unknown",o[o.BannerCloseButton=1]="BannerCloseButton",o[

/Users/berri/Library/Safari/.dat.nosync022f.PKWYac Download File
Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	1531
Entropy (8bit):	7.243139433123091
Encrypted:	false
SSDEEP:	24:/MVp+dVGmEH3oFqB2h9HoTAqg94t0uNfvvU7ws7iRNGOKkrqq/C/rraIFhAIyrf6:E3Nmr9oTlg94TfnU7Z+RZKeSeIIf5sl
MD5:	3D94D40D28A6C235A6D56D793CA52C13
SHA1:	EAF8517E7427A31C4F7977BF7E49709CA14844C2
SHA-256:	E04DF22A85CAC6C8EBC8D8D3881FBCB0D9B4ADC776D1F40D89D0731B98B7C970
SHA-512:	6A82D9FAD91AF782D33D0602E8413E6D87D61FA29DF3EF68BF808F153E7AF9D92FADC0D5FF4DAE067E6ADD30E2E59ACC736C20B63D397225322C4A9BC5FB7CA6
Malicious:	false
Reputation:	low
Preview:	bplist00.....^SessionVersion^SessionWindowsS1.0............................9_..SelectedTabIndex\TabBarHiddenZDateClosed_..FavoritesBarHidden]IsPopupWindow_. PrefersReadingListSidebarVisible\Miniaturized_..WindowStateVersionZWindowUUID_..WindowContentRectYTabStates_..IsPrivateWindow_..SelectedPinnedTabIndex...3A.b/.......S2.0_.$B2FBEBF7-61E9-40A1-ABFE-3F1B58B468C6_..{{0, 52}, {1024, 693}}.... !."#.$%&'().,-...0123456.\IsDisposable\SessionState_..AncestorTabIdentifers_..SessionStateIsEncryptedXTabIndex]LastVisitTimeWTabUUIDVTabURL]TabIdentifierXTabTitle_..ProcessIdentifierWIsMuted.O..d..e7C2...g.....@..4.I...iH.=[`..:..(...,xI...q#i.Z.y..?..4....VbsQK......K....J....s...5.........;..t`w7 .9.5wQGi\.\|@.I.d..dU.R_A.m...W.b .\|2....RlJ..>..S.,.-..@.9..sK...3.d..+.gRS.S..A.#..8is..-\f.Q.Nc#.......<Y....?F..X2-N>e.......N.6.@...H..c.D...........=25X.......#."...?.).._x=.i<a......D..1rg.T.....hD.z.......\.k........Z.BH..j.......e@u`uNF...[.......$.z.?..^.Z........6O.H..

/Users/berri/Library/Safari/.dat.nosync022f.Yka7fz Download File
Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1012
Entropy (8bit):	5.286991847916908
Encrypted:	false
SSDEEP:	24:2dfyiwHuG5Ku3hu65juqVrTrmuGoTxR1F1xW:cfyP5Z/5PrUon1F1xW
MD5:	0C29425555C7FF0CA114B1FD0DC39C50
SHA1:	D7D808E8BE92462F4C3CEBA66734F0E9BB26ACDD
SHA-256:	52826AFEEC974BB7BACB85BDC01DC4F23BF917D65E04773D7CAD393F7866F3FD
SHA-512:	D9C8364A85F4B4A96CAAC1409F32F9D6B2F8AE19201E0ABD2D449A3EEDADD471E99E44BC92DEB5D8FB60287DA64A88E61B45F759E7B9A383A9BBE5F5FD242F95
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>SingleDeviceSaveChangesThrottlingPolicy</key>..<string>1:1440</string>..<key>MultipleDeviceSaveChangesThrottlingPolicy</key>..<string>50:1 \| 10:2 \| 10:5 \| 10:30 \| 9:40 \| 1:510</string>..<key>SingleDeviceFetchChangesThrottlingPolicy</key>..<string>11:15 \| 1:1275</string>..<key>MultipleDeviceFetchChangesThrottlingPolicy</key>..<string>50:1 \| 50:3 \| 20:4 \| 20:5 \| 20:15 \| 20:18 \| 20:20</string>..<key>SyncCircleSizeRetrievalThrottlingPolicy</key>..<string>1:1440</string>..<key>MaximumRequestLimitCharacterCount</key>..<integer>100000</integer>..<key>SyncWindow</key>..<real>1209600</real>..<key>HistoryModificationIdleDelayBeforeSyncAttemptKey</key>..<integer>90</integer>..<key>HistoryRemovalIdleDelayBeforeSyncAttempt</key>..<integer>6</integer>..<key>SaveChangesBeforeTerminationTimeout</key>..<integer>1</integer>.</dic

/dev/null Download File
Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.715344460719975
Encrypted:	false
SSDEEP:	3:tUI36mKkRXF2gQzS4e/3WOv:mA6mKkxMBSBmA
MD5:	EF7CB3BE9CD85B537677D5C962937F63
SHA1:	E39B7593569195FA556C8635D621289811D10F97
SHA-256:	336C158FE73EAD994439E3D69FF37DC84BB617185D8E99F69055A0163D407283
SHA-512:	4699046BCC3618B458F86D1027F5539DDDC6D0B8FFBFC989BDDC8DD62F86E8656CB93A38D6F93CAF71D44F78B9FDB9C342F3440B37E5DFC233B3533A565FF5FB
Malicious:	false
Reputation:	low
Preview:	2021-08-11 21:41:51.542 Safari[559:5047] ApplePersistence=NO.

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/0/SafariFamily/Safari/.dat.nosync022f.F2F7tx Download File
Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.9370658315190226
Encrypted:	false
SSDEEP:	3:N1n6qMvRGNMTAnd/t1tH:N1nleRaMTAltH
MD5:	CDC65B5F112547EAFAE0F16F9C149426
SHA1:	AEAF9908A5B6FF3E2F7B738ABF5FE9E79108BA01
SHA-256:	1C6D085D871A855CE4A3902BAB4B9B92631B8EE8F0B7F6536768A2AAF427B45C
SHA-512:	E8B0E4CE6A760A718A19976D3CFE9063F04FB4BF179947AECA84E94C83F21459FB9DC0FFABEA8F633BD2D0BA94FE1E15D8C97E9604FDE8BD0DEA961EB83BDDB7
Malicious:	false
Reputation:	low
Preview:	bplist00..._..ExtensionArchivesExtracted...(...............................)

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsDirectory.db_ Download File
Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	48908
Entropy (8bit):	3.533948990143748
Encrypted:	false
SSDEEP:	384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGBOmBfbouR6/chQOnGqwc2U+v+h/:8MdGleOGmBouRwchQOnGqwc2U+v+h/
MD5:	09070E01FA6ED1973D94FAD50C35E3ED
SHA1:	7546663E66F9889EE3365A7A0BE372300C6022CA
SHA-256:	2E6EC437A97DD88F9067B2E99AC64789670D9B9C1FC50B2856E392E66163211F
SHA-512:	621399FF832F1A8352E5E9A54984B878C7D3432156D9CF9986A1A5B75662E92D9A00FA1BA6714D679286BB49E71916F72655AADA2B99880A2806FAFC6F86E7F3
Malicious:	false
Reputation:	low
Preview:	kych...........................`...X...p..S0..SX..Th..T...T...[...^h...........L...X...............T...........d...................t...............t...........<...............P...........0...........$...p...........l...........X.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...D.......................!...%@.......MDS_CDSADIR_CSSM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_KRMM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_EMM_RECORDTYPE.....L.......................!...%@......"MDS_CDSADIR_EMM_PRIMARY_RECORDTYPE.....H.......................!...%@.......MDS_CDSADIR_COMMON_RECORDTYPE......L.......................!...%@......"MDS_CDSADIR_CSP_PRIMARY_RECORDTYPE.....P.......................!...%@......%MDS_CDSADIR_CSP_CAPABILITY_R

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsObject.db_ Download File
Process:	/Applications/Safari.app/Contents/MacOS/Safari
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	3.5113078915037033
Encrypted:	false
SSDEEP:	48:m6Xsh+CLjL3Pe3T5FFKfEuyu+iYxGv4sS:3X6LjLfe3wEuyu9YxGQX
MD5:	D487F899A14AE98519B46D51BC810F1B
SHA1:	64877ECFBE47ED66EED545B2449BBE8B22B775D0
SHA-256:	4835899C464487946E281D535381D4CAB8BC90EC08CD00A6A0ECB97854E9321D
SHA-512:	EB4FABD61B4FD2B9EF3C9E93793CA5F11353A1F81EA4DA22E0F79ED45D89180B77469B9E5DCD5350AE650B31DE9018743DA7716EFA7B5CDDFC3FA7A13C476F40
Malicious:	false
Reputation:	low
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

Static File Info

No static file info

Network Behavior

Network Port Distribution

Total Packets: 64
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 11, 2021 19:41:46.098912001 CEST	49192	80	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.106843948 CEST	80	49192	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.107384920 CEST	49192	80	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.107954025 CEST	49192	80	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.115827084 CEST	80	49192	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.121783018 CEST	80	49192	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.122270107 CEST	49192	80	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.128981113 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.136868954 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.137461901 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.147699118 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.155407906 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.188366890 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.188462019 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.188966036 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.205569983 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.213397980 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.229357958 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.229424000 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.229897976 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.229950905 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.231414080 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.231456995 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.231467009 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.231532097 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.232084036 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.239329100 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.239423037 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.239474058 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.239517927 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.239728928 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.255733013 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.256176949 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.287925005 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.287975073 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288043022 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288094044 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288141012 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288184881 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288218021 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288264990 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288338900 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288388014 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288475037 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288510084 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288553953 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288599014 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288644075 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288688898 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288733959 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288778067 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288836002 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.288868904 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.289239883 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289298058 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289315939 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289329052 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289340019 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289350986 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289362907 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289374113 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289386034 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289396048 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289407015 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.289417982 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.292023897 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.292068958 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.292186022 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.292406082 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.292700052 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.293024063 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.293396950 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.293828964 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.294838905 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.294883013 CEST	49192	80	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.304529905 CEST	80	49192	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.305356026 CEST	49192	80	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:46.310693026 CEST	443	49193	104.16.148.64	192.168.11.11
Aug 11, 2021 19:41:46.311198950 CEST	49193	443	192.168.11.11	104.16.148.64
Aug 11, 2021 19:41:53.721322060 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.729443073 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.729904890 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.730426073 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.738492966 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.738591909 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.738640070 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.738686085 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.739099979 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.739146948 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.739490986 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.739543915 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.740017891 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.819926977 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.828218937 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.828277111 CEST	443	49199	17.248.145.100	192.168.11.11
Aug 11, 2021 19:41:53.828877926 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.828965902 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.864943981 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.865029097 CEST	49199	443	192.168.11.11	17.248.145.100
Aug 11, 2021 19:41:53.865041018 CEST	49199	443	192.168.11.11	17.248.145.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 11, 2021 19:41:46.085927010 CEST	60101	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:41:46.094423056 CEST	53	60101	1.1.1.1	192.168.11.11
Aug 11, 2021 19:41:51.813941956 CEST	49155	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:41:51.822818995 CEST	53	49155	1.1.1.1	192.168.11.11
Aug 11, 2021 19:41:52.297590017 CEST	49852	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:41:52.306158066 CEST	53	49852	1.1.1.1	192.168.11.11
Aug 11, 2021 19:41:52.364577055 CEST	54677	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:41:52.374073029 CEST	53	54677	1.1.1.1	192.168.11.11
Aug 11, 2021 19:41:53.709847927 CEST	55096	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:41:53.719535112 CEST	53	55096	1.1.1.1	192.168.11.11
Aug 11, 2021 19:41:53.781239986 CEST	59423	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:41:53.790591002 CEST	53	59423	1.1.1.1	192.168.11.11
Aug 11, 2021 19:42:00.416820049 CEST	56830	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:42:00.426314116 CEST	53	56830	1.1.1.1	192.168.11.11
Aug 11, 2021 19:42:01.093364000 CEST	64845	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:42:01.102942944 CEST	53	64845	1.1.1.1	192.168.11.11
Aug 11, 2021 19:42:18.243860960 CEST	53538	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:42:18.252944946 CEST	53	53538	1.1.1.1	192.168.11.11
Aug 11, 2021 19:42:54.671742916 CEST	63211	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:42:54.680540085 CEST	53	63211	1.1.1.1	192.168.11.11
Aug 11, 2021 19:42:54.933306932 CEST	57825	53	192.168.11.11	1.1.1.1
Aug 11, 2021 19:42:54.945630074 CEST	53	57825	1.1.1.1	192.168.11.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 11, 2021 19:41:46.085927010 CEST	192.168.11.11	1.1.1.1	0xdcb	Standard query (0)	cdn.cookielaw.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 11, 2021 19:41:46.094423056 CEST	1.1.1.1	192.168.11.11	0xdcb	No error (0)	cdn.cookielaw.org	104.16.148.64	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:46.094423056 CEST	1.1.1.1	192.168.11.11	0xdcb	No error (0)	cdn.cookielaw.org	104.16.149.64	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:53.719535112 CEST	1.1.1.1	192.168.11.11	0x476d	No error (0)	gateway.fe.apple-dns.net	17.248.145.100	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:53.719535112 CEST	1.1.1.1	192.168.11.11	0x476d	No error (0)	gateway.fe.apple-dns.net	17.248.145.205	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:53.719535112 CEST	1.1.1.1	192.168.11.11	0x476d	No error (0)	gateway.fe.apple-dns.net	17.248.145.140	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:53.719535112 CEST	1.1.1.1	192.168.11.11	0x476d	No error (0)	gateway.fe.apple-dns.net	17.248.145.83	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:53.719535112 CEST	1.1.1.1	192.168.11.11	0x476d	No error (0)	gateway.fe.apple-dns.net	17.248.145.139	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:53.719535112 CEST	1.1.1.1	192.168.11.11	0x476d	No error (0)	gateway.fe.apple-dns.net	17.248.145.239	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:53.719535112 CEST	1.1.1.1	192.168.11.11	0x476d	No error (0)	gateway.fe.apple-dns.net	17.248.145.167	A (IP address)	IN (0x0001)
Aug 11, 2021 19:41:53.719535112 CEST	1.1.1.1	192.168.11.11	0x476d	No error (0)	gateway.fe.apple-dns.net	17.248.145.210	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.cookielaw.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.11	49192	104.16.148.64	80

Timestamp	kBytes transferred	Direction	Data
Aug 11, 2021 19:41:46.107954025 CEST	0	OUT	GET /scripttemplates/otSDKStub.js HTTP/1.1 Host: cdn.cookielaw.org User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15 Accept: /
Aug 11, 2021 19:41:46.121783018 CEST	1	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 11 Aug 2021 17:41:46 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Wed, 11 Aug 2021 18:41:46 GMT Location: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 67d341b3284005d8-FRA Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 11, 2021 19:41:46.188462019 CEST	104.16.148.64	443	192.168.11.11	49193	CN=cookielaw.org, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jun 01 02:00:00 CEST 2021 Mon Jan 27 13:48:08 CET 2020	Wed Jun 01 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	771,52244-52243-52245-49200-49196-49192-49188-49172-49162-163-159-107-106-57-56-65413-196-195-136-135-129-49202-49198-49194-49190-49167-49157-157-61-53-192-132-49199-49195-49191-49187-49171-49161-162-158-103-64-51-50-190-189-69-68-49201-49197-49193-49189-49166-49156-156-60-47-186-65-49170-49160-22-19-49165-49155-10-255,0-11-10-13-13172-16-21,14-13-25-28-11-12-27-24-9-10-26-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2	2a26b1a62e40d25d4de3babc9d532f30
Aug 11, 2021 19:41:46.188462019 CEST	104.16.148.64	443	192.168.11.11	49193	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		2a26b1a62e40d25d4de3babc9d532f30
Aug 11, 2021 19:41:53.739490986 CEST	17.248.145.100	443	192.168.11.11	49199	C=US, ST=California, O=Apple Inc., CN=gateway.icloud.com C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1 C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1	C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1 CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE CN=GeoTrust Global CA, O=GeoTrust Inc., C=US	Tue Jun 22 13:54:06 CEST 2021 Wed Dec 12 13:00:00 CET 2018 Mon Jun 16 17:42:02 CEST 2014	Fri Jul 22 13:54:05 CEST 2022 Wed May 07 14:00:00 CEST 2025 Fri May 20 17:42:02 CEST 2022	771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47,65281-0-23-13-5-13172-18-16-11-10,29-23-24,0	3e4e87dda5a3162306609b7e330441d2
					C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Dec 12 13:00:00 CET 2018	Wed May 07 14:00:00 CEST 2025
					C=US, O=Apple Inc., OU=Certification Authority, CN=Apple IST CA 2 - G1	CN=GeoTrust Global CA, O=GeoTrust Inc., C=US	Mon Jun 16 17:42:02 CEST 2014	Fri May 20 17:42:02 CEST 2022

System Behavior

Analysis Process: mono-sgen32 PID: 552 Parent PID: 477

General

Start time:	19:41:45
Start date:	11/08/2021
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	n/a
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Analysis Process: curl PID: 552 Parent PID: 477

General

Start time:	19:41:45
Start date:	11/08/2021
Path:	/usr/bin/curl
Arguments:
File size:	185104 bytes
MD5 hash:	078cd73f58d3d8f875eed22522ff73f7

File Activities

File Created

File Read

File Written

Analysis Process: xpcproxy PID: 559 Parent PID: 1

General

Start time:	19:41:51
Start date:	11/08/2021
Path:	/usr/libexec/xpcproxy
Arguments:	n/a
File size:	43488 bytes
MD5 hash:	d1bb9a4899f0af921e8188218b20d744

File Activities

File Read

Directory Created

Analysis Process: Safari PID: 559 Parent PID: 1

General

Start time:	19:41:51
Start date:	11/08/2021
Path:	/Applications/Safari.app/Contents/MacOS/Safari
Arguments:	/Applications/Safari.app/Contents/MacOS/Safari
File size:	20896 bytes
MD5 hash:	8e18be737fe87f19fe7a97b4821e2005

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify plist files to run a program during system boot or user login. Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as `/Library/Preferences` (which execute with elevated privileges) and `~/Library/Preferences` (which execute with a user's privileges).
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

macOS Analysis Report http://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Overview

General Information

Detection

Signatures

Classification

General Information

Process Tree

Yara Overview

Jbx Signature Overview

Compliance:

Networking:

System Summary:

Persistence and Installation Behavior:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Runtime Messages

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

System Behavior

Analysis Process: mono-sgen32 PID: 552 Parent PID: 477

General

Analysis Process: curl PID: 552 Parent PID: 477

General

File Activities

File Created

File Read

File Written

Analysis Process: xpcproxy PID: 559 Parent PID: 1

General

File Activities

File Read

Directory Created

Analysis Process: Safari PID: 559 Parent PID: 1

General

File Activities

File Created

File Deleted

File Read

File Written

File Moved

Directory Enumerated

Directory Attributes Enumerated Bulk

Directory Created