Overview

overview

10

Static

static

10

dicker.jar

macos-10.15-amd64

4

Analysis

  • max time kernel
    39s
  • max time network
    46s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240711.1-en
  • resource tags

    arch:amd64arch:i386image:macos-20240711.1-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    20/10/2024, 08:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dicker.jar

  • Size

    639KB

  • MD5

    0fa89fdc517bb49bbb26d6b87cd8b604

  • SHA1

    1ed2b8c0807732f251db69fe0573507f8a6b5bbf

  • SHA256

    fb19934aeba01e2fd743d292e8bc74ab527acd38af401290ce4e10be1d5c2acc

  • SHA512

    d9e22cd6671fe71660d011e71b823b628e1ead9f8355e08294a8f6bcac82f8915f9070c689873952c317617df367c5536c8596b976f11ca5f742891b60426e6a

  • SSDEEP

    12288:oXXjQP/JN7e9d41bI3OXge/jR7+dpENmf4gm92RDS3wu021kSEBDMD:oXTQXrer4VXXgetiImfFglwup13EBDMD

Score
4/10
evasionexecution

Malware Config

Signatures

  • JavaScript 1 TTPs 1 IoCs

    Adversaries may abuse various implementations of JavaScript for execution.

    execution
  • Resource Forking 1 TTPs 2 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"open /Users/run/dicker.jar\""
    1⤵
      PID:486
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"open /Users/run/dicker.jar\""
      1⤵
        PID:486
      • /usr/bin/sudo
        sudo /bin/zsh -c "open /Users/run/dicker.jar"
        1⤵
          PID:486
          • /bin/zsh
            /bin/zsh -c "open /Users/run/dicker.jar"
            2⤵
              PID:488
            • /usr/bin/open
              open /Users/run/dicker.jar
              2⤵
                PID:488
            • /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
              "/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
              1⤵
                PID:472
              • /usr/libexec/pkreporter
                /usr/libexec/pkreporter
                1⤵
                  PID:477
                • /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                  /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                  1⤵
                    PID:474
                  • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                    /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
                    1⤵
                      PID:480
                    • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                      "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                      1⤵
                        PID:482
                      • /usr/libexec/xpcproxy
                        xpcproxy com.apple.JarLauncher.1532
                        1⤵
                          PID:489
                        • /System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
                          "/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
                          1⤵
                            PID:489
                            • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
                              "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/dicker.jar
                              2⤵
                                PID:491
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.metadata.mdwrite
                              1⤵
                                PID:490
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.spindump
                                1⤵
                                  PID:517
                                • /usr/sbin/spindump
                                  /usr/sbin/spindump
                                  1⤵
                                    PID:517
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.tailspind
                                    1⤵
                                      PID:518
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.spindump_agent
                                      1⤵
                                        PID:519
                                      • /usr/libexec/tailspind
                                        /usr/libexec/tailspind
                                        1⤵
                                          PID:518
                                        • /usr/libexec/spindump_agent
                                          /usr/libexec/spindump_agent
                                          1⤵
                                            PID:519
                                          • /usr/libexec/xpcproxy
                                            xpcproxy com.apple.audio.AudioComponentRegistrar
                                            1⤵
                                              PID:520
                                            • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                                              /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                                              1⤵
                                                PID:520

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads