File f461d4f5e60c33607880c87c1794087651bd0e870b789e14f392f7392a6fb7dd

Size 17.2MB
Type Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE>] [arm64]
MD5 2d9082d77b8f16bda15e5bbddd0bc0b1
SHA1 37c399c6522d884b89256960d16ad383f4a78036
SHA256 f461d4f5e60c33607880c87c1794087651bd0e870b789e14f392f7392a6fb7dd
SHA512
9b1986deb41e0037248fcda6df90ac08a36a65aa3ebeceb09d39494ccf671fba77df40b57a06e86d947ae53a4d9530ffa7f50fb5d58ca6b24ea61abb0101bb89
CRC32 86BC4D6C
ssdeep None
Yara None matched

Score

This file is very suspicious, with a score of 10.0 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.


Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE April 11, 2025, 2:05 p.m. April 11, 2025, 2:11 p.m. 386 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-04-11 05:30:49,001 [root] DEBUG: Starting analyzer from: /tmp/tmpDD8QvA
2025-04-11 05:30:49,002 [root] DEBUG: Storing results at: /tmp/hxlFCWUJZ
2025-04-11 05:30:49,003 [root] ERROR: Traceback (most recent call last):
  File "/tmp/tmpDD8QvA/analyzer.py", line 340, in <module>
    success = analyzer.run()
  File "/tmp/tmpDD8QvA/analyzer.py", line 129, in run
    self.config.file_name, **kwargs)
  File "/tmp/tmpDD8QvA/lib/core/packages.py", line 42, in choose_package_class
    "exist.".format(name))
Exception: Unable to import package "o": it does not exist.
Traceback (most recent call last):
  File "/tmp/tmpDD8QvA/analyzer.py", line 340, in <module>
    success = analyzer.run()
  File "/tmp/tmpDD8QvA/analyzer.py", line 129, in run
    self.config.file_name, **kwargs)
  File "/tmp/tmpDD8QvA/lib/core/packages.py", line 42, in choose_package_class
    "exist.".format(name))
Exception: Unable to import package "o": it does not exist.

Cuckoo Log

2025-04-11 14:05:21,536 [cuckoo.core.scheduler] INFO: Task #6271070: acquired machine Ubuntu1904x645 (label=Ubuntu1904x645)
2025-04-11 14:05:21,540 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.105 for task #6271070
2025-04-11 14:05:21,895 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3095076 (interface=vboxnet0, host=192.168.168.105)
2025-04-11 14:05:21,928 [cuckoo.machinery.virtualbox] DEBUG: Starting vm Ubuntu1904x645
2025-04-11 14:05:22,565 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine Ubuntu1904x645 to Snapshot
2025-04-11 14:08:56,532 [cuckoo.core.guest] INFO: Starting analysis #6271070 on guest (id=Ubuntu1904x645, ip=192.168.168.105)
2025-04-11 14:08:57,537 [cuckoo.core.guest] DEBUG: Ubuntu1904x645: not ready yet
2025-04-11 14:09:02,560 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=Ubuntu1904x645, ip=192.168.168.105)
2025-04-11 14:09:02,577 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=Ubuntu1904x645, ip=192.168.168.105, monitor=latest, size=73219)
2025-04-11 14:09:03,074 [cuckoo.core.resultserver] DEBUG: Task #6271070: live log analysis.log initialized.
2025-04-11 14:09:05,985 [cuckoo.core.guest] INFO: Ubuntu1904x645: analysis completed successfully
2025-04-11 14:09:06,223 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-04-11 14:09:06,250 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-04-11 14:09:07,232 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label Ubuntu1904x645 to path /srv/cuckoo/cwd/storage/analyses/6271070/memory.dmp
2025-04-11 14:09:07,236 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm Ubuntu1904x645
2025-04-11 14:11:45,061 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.105 for task #6271070
2025-04-11 14:11:46,862 [cuckoo.core.scheduler] DEBUG: Released database task #6271070
2025-04-11 14:11:46,884 [cuckoo.core.scheduler] INFO: Task #6271070: analysis procedure completed

Signatures

File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 events)
ESET-NOD32 a variant of OSX/PSW.Agent.DR
Avast MacOS:MalwareX-gen [Misc]
AVG MacOS:MalwareX-gen [Misc]
File has been identified by 5 AntiVirus engine on IRMA as malicious (5 events)
Avast Core Security (Linux) MacOS:MalwareX-gen [Misc]
WithSecure (Linux) Trojan.TR/AVI.Agent.dniou
ESET Security (Windows) a variant of OSX/PSW.Agent.DR trojan
Sophos Anti-Virus (Linux) OSX/InfoStl-EQ
Kaspersky Standard (Windows) HEUR:Trojan-PSW.OSX.Amos.ai
Screenshots
No screenshots available.
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.