Overview

overview

4

Static

static

1

Andromeda ...IX.jar

macos-10.15-amd64

4

Analysis

  • max time kernel
    28s
  • max time network
    30s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    28/08/2024, 22:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Andromeda Bridge Bot FIX.jar

  • Size

    14KB

  • MD5

    b0a70c9d2bafca88b7f3320991c5b6e9

  • SHA1

    4c72d72451771e71a2cae7cf3e526a2941a72fcf

  • SHA256

    0149a548d968766f874493db83b8772b3b8316435a812486688b9f8ddc29cdfb

  • SHA512

    c504baf461b2daa8da0b958b77d17e263b5534d2bbf077ad94031386e16520a3366c80dd8965e78bf5862b4b297b70aab8c89b888dd81d17bd30d11ab3a8d214

  • SSDEEP

    384:x3BskBDmCJrbl1/LEvP8WXFzAN7nxYWNBGc:fskByoNi91zQTxYWT

Score
4/10
execution

Malware Config

Signatures

  • JavaScript 1 TTPs 1 IoCs

    Adversaries may abuse various implementations of JavaScript for execution.

    execution

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"open /Users/run/Andromeda\\ Bridge\\ Bot\\ FIX.jar\""
    1⤵
      PID:482
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"open /Users/run/Andromeda\\ Bridge\\ Bot\\ FIX.jar\""
      1⤵
        PID:482
      • /usr/bin/sudo
        sudo /bin/zsh -c "open /Users/run/Andromeda\\ Bridge\\ Bot\\ FIX.jar"
        1⤵
          PID:482
          • /bin/zsh
            /bin/zsh -c "open /Users/run/Andromeda\\ Bridge\\ Bot\\ FIX.jar"
            2⤵
              PID:485
            • /usr/bin/open
              open "/Users/run/Andromeda Bridge Bot FIX.jar"
              2⤵
                PID:485
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.JarLauncher.1532
              1⤵
                PID:486
              • /System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
                "/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
                1⤵
                  PID:486
                  • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
                    "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar "/Users/run/Andromeda Bridge Bot FIX.jar"
                    2⤵
                      PID:488
                  • /usr/libexec/xpcproxy
                    xpcproxy com.apple.metadata.mdwrite
                    1⤵
                      PID:487
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                      1⤵
                        PID:515
                      • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                        1⤵
                          PID:515
                        • /bin/launchctl
                          /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                          1⤵
                            PID:516
                          • /bin/launchctl
                            /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                            1⤵
                              PID:517
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.ncplugin.weather 316
                              1⤵
                                PID:519
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.ncplugin.stocks 316
                                1⤵
                                  PID:520
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.iCal.CalendarNC 316
                                  1⤵
                                    PID:521
                                  • /System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
                                    /System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
                                    1⤵
                                      PID:519
                                    • /System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
                                      /System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
                                      1⤵
                                        PID:520
                                      • /System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
                                        /System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
                                        1⤵
                                          PID:521

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads