macOS Analysis Report
Install FxFactory 8.0.15.pkg

ID:	1427954
Product:	CloudBasic
Start time:	11:33:19
Start date:	18.04.2024
Sample:	Install FxFactory 8.0.15.pkg
Cookbook:	defaultmacfilecookbook.jbs
System description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
Architecture:	MAC
MD5:	d0b6dea52fb7260db0ad4eeb0398756a
SHA1:	d0b0ba9d4e6c33f1e42f6655e53eab5630cd93e3
SHA256:	12d8180c4b86515d7229c3abc7f1dd0e2a14c11d1fab7a975ca3cd5d81142f51
Filetype:	Safari Extension (4004/1) 80.00%

Name	Type	MD5	SHA1	SHA256
/dev/null	ASCII text	30EF4A0151F1213634D37AB9FE0E418B	D99A03E77D2F982AD2C4A7BEC8F1C107115E4292	6022AD1AE993BAC4FFB613D1B158A5A4A4AD2BBA2536F32045553464EAD7C74A
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/mds/mdsDirectory.db_	Mac OS X Keychain File	0E4A0D1CEB2AF6F0F8D0167CE77BE2D3	414BA4C1DC5FC8BF53D550E296FD6F5AD669918C	CCA093BCFC65E25DD77C849866E110DF72526DFFBE29D76E11E29C7D888A4030
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/mds/mdsObject.db_	Mac OS X Keychain File	D3A1859E6EC593505CC882E6DEF48FC8	F8E6728E3E9DE477A75706FAA95CEAD9CE13CB32	3EBAFA97782204A4A1D75CFEC22E15FCDEAB45B65BAB3B3E65508707E034A16C

Compliance

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49368 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49404 version: TLS 1.2

Networking

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.18
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.16
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.16
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.193.16
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: apis.apple.map.fastly.net

Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: http://crl.apple.com/applerootcag3.crl0
Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: http://crl.apple.com/root.crl0
Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: http://crl.apple.com/timestamp.crl0
Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: http://ocsp.apple.com/ocsp03-applerootcag307
Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: http://ocsp.apple.com/ocsp03-asica4020
Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: http://ocsp.apple.com/ocsp03-devid070
Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: http://www.apple.com/appleca0
Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: http://www.apple.com/certificateauthority/0
Source: Install FxFactory 8.0.15.pkg	String found in binary or memory: https://www.apple.com/appleca/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 49351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 49397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49380
Source: unknown	Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49371
Source: unknown	Network traffic detected: HTTP traffic on port 49371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49404

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49368 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49371 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49404 version: TLS 1.2

System Summary

Source: classification engine

Classification label: clean2.macPKG@0/3@3/0

Persistence and Installation Behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)

CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist

Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)

Security framework info plist opened: /System/Library/Frameworks/Security.framework/Resources/Info.plist

Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Malware Analysis System Evasion

Source: Install FxFactory 8.0.15.pkg, Payload

Binary or memory string: ThGfs

Language, Device and Operating System Detection

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)	Sysctl read request: hw.cpu_freq (6.15)			Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)	Sysctl read request: hw.ncpu (6.3)			Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)	Sysctl read request: hw.memsize (6.24)			Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)	Sysctl read request: hw.availcpu (6.25)			Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Source: /usr/bin/open (PID: 621)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior
Source: /System/Library/CoreServices/Installer.app/Contents/MacOS/Installer (PID: 622)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist			Jump to behavior