Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

#Ud83d#Udcde.htm

HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators

initial sample

Details

Filetype:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Entropy:	6.001485823782198
Filename:	#Ud83d#Udcde.htm
Filesize:	5008
MD5:	5d44cee8d28cebf028ac3afc7c4309d0
SHA1:	b53e4a9f2a2efe93ca896cd6a56af26bf861cf0f
SHA256:	c77e9dbffd377fe486c902715fd1d5587c2c7ef58cfb2839284d109a72a6a645
SHA512:	5b780cf8fe3e3ae18ef82c5ce00cdcbc21a591bd4283a2169446c2fff5d5728f9730f9382f093760e44d7734940cc599d954cc3f0b7fde04fa4e4b599215f32a
SSDEEP:	96:RPCt3y7Xc3CXZXXbFn+jk2EYi3hmU3ZVrkqsnQaKA9jhGZxTc0hLat:gt3y7XfXZXEk2EYi3hV3ZPSUrZxXg
Preview:	<!DOCTYPE html><html><head><script>var mizzs="Y2hlcnJ5cEB1d2diLmVkdQ=="</script>..<script>var paso1="@!&wAV9fCcXIbQnz4oSp@&!OehA8igcfspk3JE5MoTRF1DZPdwS6&@!";if(window.location.href.indexOf("bbre=")==-1) window.location.href = document.location.pathname+"

/Users/berri/Library/Safari/.dat.nosync023d.KFEApc

Apple binary property list

dropped

Details

File:	/Users/berri/Library/Safari/.dat.nosync023d.KFEApc
Category:	dropped
Dump:	.dat.nosync023d.KFEApc.274.dr
ID:	dr_5
Target ID:	274
Process:	/Applications/Safari.app/Contents/MacOS/Safari
Type:	Apple binary property list
Entropy:	7.4143084009938045
Encrypted:	false
Ssdeep:	48:E3NmrW2oTlg9VeQWRLYDBLrZPiM/bu9ueXy:zWzA4vklLrZPJbuVy
Size:	1963
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Writes property list (.plist) files to disk	Persistence and Installation Behavior	Plist Modification

/Users/berri/Library/Safari/.dat.nosync023d.M2fcej

XML 1.0 document, ASCII text

dropped

Details

File:	/Users/berri/Library/Safari/.dat.nosync023d.M2fcej
Category:	dropped
Dump:	.dat.nosync023d.M2fcej.274.dr
ID:	dr_3
Target ID:	274
Process:	/Applications/Safari.app/Contents/MacOS/Safari
Type:	XML 1.0 document, ASCII text
Entropy:	5.286991847916908
Encrypted:	false
Ssdeep:	24:2dfyiwHuG5Ku3hu65juqVrTrmuGoTxR1F1xW:cfyP5Z/5PrUon1F1xW
Size:	1012
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Writes property list (.plist) files to disk	Persistence and Installation Behavior	Plist Modification

/dev/null

ASCII text

dropped

Details

File:	/dev/null
Category:	dropped
Dump:	null.274.dr
ID:	dr_2
Target ID:	274
Process:	/Applications/Safari.app/Contents/MacOS/Safari
Type:	ASCII text
Entropy:	4.8180438460722765
Encrypted:	false
Ssdeep:	3:tUI7ocFzf4HzS9df3WOv:mMHw2dfmA
Size:	61
Whitelisted:	false
Reputation:	low

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/0/SafariFamily/Safari/.dat.nosync023d.coDlpE

Apple binary property list

dropped

Details

File:	/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/0/SafariFamily/Safari/.dat.nosync023d.coDlpE
Category:	dropped
Dump:	.dat.nosync023d.coDlpE.274.dr
ID:	dr_4
Target ID:	274
Process:	/Applications/Safari.app/Contents/MacOS/Safari
Type:	Apple binary property list
Entropy:	3.9370658315190226
Encrypted:	false
Ssdeep:	3:N1n6qMvRGNMTAnd/t1tH:N1nleRaMTAltH
Size:	76
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Writes property list (.plist) files to disk	Persistence and Installation Behavior	Plist Modification

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsDirectory.db_

Mac OS X Keychain File

dropped

Details

File:	/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsDirectory.db_
Category:	dropped
Dump:	mdsDirectory.db_.274.dr
ID:	dr_1
Target ID:	274
Process:	/Applications/Safari.app/Contents/MacOS/Safari
Type:	Mac OS X Keychain File
Entropy:	3.533948990143748
Encrypted:	false
Ssdeep:	384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGBOmBfbouR6/chQOnGqwc2U+v+h/:8MdGleOGmBouRwchQOnGqwc2U+v+h/
Size:	48908
Whitelisted:	false
Reputation:	moderate

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsObject.db_

Mac OS X Keychain File

dropped

Details

File:	/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsObject.db_
Category:	dropped
Dump:	mdsObject.db_.274.dr
ID:	dr_0
Target ID:	274
Process:	/Applications/Safari.app/Contents/MacOS/Safari
Type:	Mac OS X Keychain File
Entropy:	3.5113078915037033
Encrypted:	false
Ssdeep:	48:m6Xsh+CLjL3Pe3T5FFKfEuyu+iYxGv4sS:3X6LjLfe3wEuyu9YxGQX
Size:	4404
Whitelisted:	false
Reputation:	moderate

Processes

Path

Cmdline

Malicious

/usr/libexec/xpcproxy

n/a

Details

PID:	573
Target ID:	273
Parent PID:	1
Name:	xpcproxy
Path:	/usr/libexec/xpcproxy
Commandline:	n/a
Size:	43488
MD5:	d1bb9a4899f0af921e8188218b20d744
Time:	17:19:30
Date:	09/04/2021

/Applications/Safari.app/Contents/MacOS/Safari

Details

PID:	573
Target ID:	274
Parent PID:	1
Name:	Safari
Path:	/Applications/Safari.app/Contents/MacOS/Safari
Commandline:	/Applications/Safari.app/Contents/MacOS/Safari
Size:	20896
MD5:	8e18be737fe87f19fe7a97b4821e2005
Time:	17:19:30
Date:	09/04/2021

Domains

Name

Malicious

mamodmiappscn.firebaseapp.com

151.101.1.195

gateway.fe.apple-dns.net

17.248.145.229

cdnjs.cloudflare.com

104.16.18.94

Details

Name:	cdnjs.cloudflare.com
IP:	104.16.18.94
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

unpkg.com

104.16.124.175

Details

Name:	unpkg.com
IP:	104.16.124.175
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

sslcnd.aioecoin.org

172.67.176.224

Details

Name:	sslcnd.aioecoin.org
IP:	172.67.176.224
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

17.171.27.65

unknown

United States

Details

IP:	17.171.27.65
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	714
ASN name:	APPLE-ENGINEERINGUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

17.253.109.201

unknown

United States

Details

IP:	17.253.109.201
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	6185
ASN name:	APPLE-AUSTINUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

17.248.145.229

gateway.fe.apple-dns.net

United States

Details

IP:	17.248.145.229
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	714
ASN name:	APPLE-ENGINEERINGUS
Private:	false
Domain:	gateway.fe.apple-dns.net

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

172.67.176.224

sslcnd.aioecoin.org

United States

Details

IP:	172.67.176.224
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	sslcnd.aioecoin.org

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

151.101.1.195

mamodmiappscn.firebaseapp.com

United States

Details

IP:	151.101.1.195
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	54113
ASN name:	FASTLYUS
Private:	false
Domain:	mamodmiappscn.firebaseapp.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

2.20.214.243

unknown

European Union

Details

IP:	2.20.214.243
TargetID:	-1
Country:	European Union
Countrycode:	EU
ASN number:	16625
ASN name:	AKAMAI-ASUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking

104.16.124.175

unpkg.com

United States

Details

IP:	104.16.124.175
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	unpkg.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

104.16.18.94

cdnjs.cloudflare.com

United States

Details

IP:	104.16.18.94
TargetID:	-1
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	cdnjs.cloudflare.com

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

Domains

IPs