hxxps://abra--5e4bd525[.]api[.]cosmic-crab[.]buzz/81954936b3bd415e52ad6d1f5f389e5ecb229856/HALFTIME[.]dmg?api-key=8acbcf1e-732c-4574-a3bf-27e6a85b86f1&download=true&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9[.]eyJleHAiOjE3ODY0MDM5NjUsInJhdGUiOiI1TSIsInJvbGUiOiJmcmVlIiwic2Vzc2lvbklEIjoiTVRjNE5qTXhOelUwTm54T2QzZEJUa1ZHVTFSR2NFbFVNRGd3VWtSUk1WVkdVa0pWYWtreFZEQkdWVlJGTVVkUk1VSk9WSHBPVVZKRk5WcFRWVTVRVmxSV1ZGUnFZM2xPUm1oRVZtdFNUVk5WVmtsT1ZVVTlmRjN0NVZSUG9tSl9hbS1VRWpFbDNYMDR3eHRGbVVpejFibHpPa3k4VlJveiIsImRvbWFpbiI6IndlYnRvci5pbyIsImFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE1MS4wLjAuMCBTYWZhcmkvNTM3LjM2IiwicmVtb3RlQWRkcmVzcyI6Ijc1LjkwLjAuOTQifQ[.]xrBPgFpLvqQCE_F6iY-T7GVPejxIRmQhRq8tnxEI_PQ

General

Target
https://abra--5e4bd525.api.cosmic-crab.buzz/81954936b3bd415e52ad6d1f5f389e5ecb229856/HALFTIME.dmg?api-key=8acbcf1e-732c-4574-a3bf-27e6a85b86f1&download=true&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3ODY0MDM5NjUsInJhdGUiOiI1TSIsInJvbGUiOiJmcmVlIiwic2Vzc2lvbklEIjoiTVRjNE5qTXhOelUwTm54T2QzZEJUa1ZHVTFSR2NFbFVNRGd3VWtSUk1WVkdVa0pWYWtreFZEQkdWVlJGTVVkUk1VSk9WSHBPVVZKRk5WcFRWVTVRVmxSV1ZGUnFZM2xPUm1oRVZtdFNUVk5WVmtsT1ZVVTlmRjN0NVZSUG9tSl9hbS1VRWpFbDNYMDR3eHRGbVVpejFibHpPa3k4VlJveiIsImRvbWFpbiI6IndlYnRvci5pbyIsImFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE1MS4wLjAuMCBTYWZhcmkvNTM3LjM2IiwicmVtb3RlQWRkcmVzcyI6Ijc1LjkwLjAuOTQifQ.xrBPgFpLvqQCE_F6iY-T7GVPejxIRmQhRq8tnxEI_PQ
Sample260809-3a8r3afj91

Score

8^/10

Malware Config

Targets

- Target
  https://abra--5e4bd525.api.cosmic-crab.buzz/81954936b3bd415e52ad6d1f5f389e5ecb229856/HALFTIME.dmg?api-key=8acbcf1e-732c-4574-a3bf-27e6a85b86f1&download=true&token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3ODY0MDM5NjUsInJhdGUiOiI1TSIsInJvbGUiOiJmcmVlIiwic2Vzc2lvbklEIjoiTVRjNE5qTXhOelUwTm54T2QzZEJUa1ZHVTFSR2NFbFVNRGd3VWtSUk1WVkdVa0pWYWtreFZEQkdWVlJGTVVkUk1VSk9WSHBPVVZKRk5WcFRWVTVRVmxSV1ZGUnFZM2xPUm1oRVZtdFNUVk5WVmtsT1ZVVTlmRjN0NVZSUG9tSl9hbS1VRWpFbDNYMDR3eHRGbVVpejFibHpPa3k4VlJveiIsImRvbWFpbiI6IndlYnRvci5pbyIsImFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE1MS4wLjAuMCBTYWZhcmkvNTM3LjM2IiwicmVtb3RlQWRkcmVzcyI6Ijc1LjkwLjAuOTQifQ.xrBPgFpLvqQCE_F6iY-T7GVPejxIRmQhRq8tnxEI_PQ
Score

8^/10

defense_evasion discovery
- Path Permission
  Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
  defense_evasion
- Gatekeeper Bypass
  Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
  defense_evasion
- File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
  defense_evasion
behavioral1