Analysis Report #Ud83d#Udcde.htm

Overview

General Information

Sample Name: #Ud83d#Udcde.htm
Analysis ID: 550
MD5: 5d44cee8d28cebf028ac3afc7c4309d0
SHA1: b53e4a9f2a2efe93ca896cd6a56af26bf861cf0f
SHA256: c77e9dbffd377fe486c902715fd1d5587c2c7ef58cfb2839284d109a72a6a645
Infos:

Most interesting Screenshot:

Detection

HTMLPhisher
Score: 48
Range: 0 - 100
Whitelisted: false

Signatures

Yara detected HtmlPhish35
Opens the Safari browser app

Classification

Phishing:

barindex
Yara detected HtmlPhish35
Source: Yara match File source: #Ud83d#Udcde.htm, type: SAMPLE
Source: unknown HTTPS traffic detected: 17.248.145.229:443 -> 192.168.11.11:49254 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.176.224:443 -> 192.168.11.11:49256 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.11.11:49257 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.124.175:443 -> 192.168.11.11:49258 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.18.94:443 -> 192.168.11.11:49259 version: TLS 1.2

Networking:

barindex
Source: unknown TCP traffic detected without corresponding DNS query: 17.171.27.65
Source: unknown TCP traffic detected without corresponding DNS query: 17.171.27.65
Source: unknown TCP traffic detected without corresponding DNS query: 17.171.27.65
Source: unknown TCP traffic detected without corresponding DNS query: 17.171.27.65
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.109.201
Source: unknown TCP traffic detected without corresponding DNS query: 2.20.214.243
Source: unknown TCP traffic detected without corresponding DNS query: 2.20.214.243
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.109.201
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown DNS traffic detected: queries for: sslcnd.aioecoin.org
Source: .dat.nosync023d.M2fcej.274.dr String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49238
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49259
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49258
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49257
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49256
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49254
Source: unknown Network traffic detected: HTTP traffic on port 49254 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49256 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49257 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49258 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49259 -> 443
Source: unknown HTTPS traffic detected: 17.248.145.229:443 -> 192.168.11.11:49254 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.176.224:443 -> 192.168.11.11:49256 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.1.195:443 -> 192.168.11.11:49257 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.124.175:443 -> 192.168.11.11:49258 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.16.18.94:443 -> 192.168.11.11:49259 version: TLS 1.2
Source: classification engine Classification label: mal48.phis.macHTM@0/6@4/0

Persistence and Installation Behavior:

barindex
Opens the Safari browser app
Source: /usr/libexec/xpcproxy (PID: 573) Safari app opened: /Applications/Safari.app/Contents/MacOS/Safari Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 573) Random device file read: /dev/urandom Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 573) AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist Jump to behavior
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 573) XML plist file created: /Users/berri/Library/Safari/.dat.nosync023d.M2fcej Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 573) Binary plist file created: /private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/0/SafariFamily/Safari/.dat.nosync023d.coDlpE Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 573) Binary plist file created: /Users/berri/Library/Safari/.dat.nosync023d.KFEApc Jump to dropped file
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 573) System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist Jump to behavior
cam-macmac-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
17.171.27.65
 unknown United States
714 APPLE-ENGINEERINGUS false
17.253.109.201
 unknown United States
6185 APPLE-AUSTINUS false
17.248.145.229
 gateway.fe.apple-dns.net United States
714 APPLE-ENGINEERINGUS false
172.67.176.224
 sslcnd.aioecoin.org United States
13335 CLOUDFLARENETUS false
151.101.1.195
 mamodmiappscn.firebaseapp.com United States
54113 FASTLYUS false
2.20.214.243
 unknown European Union
16625 AKAMAI-ASUS false
104.16.124.175
 unpkg.com United States
13335 CLOUDFLARENETUS false
104.16.18.94
 cdnjs.cloudflare.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
mamodmiappscn.firebaseapp.com 151.101.1.195 true
gateway.fe.apple-dns.net 17.248.145.229 true
cdnjs.cloudflare.com 104.16.18.94 true
unpkg.com 104.16.124.175 true
sslcnd.aioecoin.org 172.67.176.224 true