bee6478162bf61533715227652453ce27a603f371dd1f96bdd0574f6fed20f15

Analysis

max time kernel
148s
max time network
175s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
26/04/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
packages/VoodooHDA-Tahoe.pkg
Size 881KB
Sample260426-srtpcsc12p
SHA256 bee6478162bf61533715227652453ce27a603f371dd1f96bdd0574f6fed20f15
MD5 654529eb9cd94daeaa7ab0cac899e6b8
SHA1 b68273d2833f4d779bedecdabb8d00433a75e58c
SHA512 c771d13c8798658b3943eed9f80667a3e9e18e467b04dcaea314d0d5d2ad42d03754d2d258f13f8b0089028aefd527d8cd6b8084b47fe2d8e19c9a282406ffc6
SSDEEP 12288:aYopZE7kGCe07WE3J1wbAhKj4dK2BPHHy3ZWLjB9dQ8v54RYm5RBsyfiXCgqT50o:aYL87RgAEM1PypWvveRY1yqXC3T51
TLSH
T1C7152321D6C361912837B3B9DFCA0A4926DF092E37861276AF467CDFA53021E7D77A04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Path Permission 1 TTPs
Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002
File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Installer Packages 1 TTPs 2 IoCs

Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system.

persistence

Installer Packages

T1546.016

ioc	Process
/tmp/PKInstallSandbox.tkeu4d/Scripts/com.VoodooHDATahoe.soOpr3/postinstall /Users/run/setup.pkg /Private/tmp / /	Process not Found
/bin/sh /tmp/PKInstallSandbox.tkeu4d/Scripts/com.VoodooHDATahoe.soOpr3/postinstall /Users/run/setup.pkg /Private/tmp / /	Process not Found

File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
defense_evasion

File Deletion
T1070.004

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/990118B9-5039-4A00-9ABB-00E8B11B656B.activeSandbox/Root /	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c	Process not Found

Command and Scripting Interpreter 1 TTPs
Adversaries may abuse Unix shell commands and scripts for execution.
execution

Unix Shell
T1059.004

/bin/sh
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:502

/bin/bash
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:502

/usr/bin/sudo
sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
1⤵
PID:502
- /bin/zsh
  /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
  2⤵
  PID:503
- /usr/sbin/installer
  installer -pkg /Users/run/setup.pkg -target /
  2⤵
  PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:504

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:504

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:505

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/990118B9-5039-4A00-9ABB-00E8B11B656B.activeSandbox/Root /
1⤵
PID:506

/tmp/PKInstallSandbox.tkeu4d/Scripts/com.VoodooHDATahoe.soOpr3/postinstall
/tmp/PKInstallSandbox.tkeu4d/Scripts/com.VoodooHDATahoe.soOpr3/postinstall /Users/run/setup.pkg /Private/tmp / /
1⤵
PID:507

/bin/bash
/bin/sh /tmp/PKInstallSandbox.tkeu4d/Scripts/com.VoodooHDATahoe.soOpr3/postinstall /Users/run/setup.pkg /Private/tmp / /
1⤵
PID:507
- /bin/chmod
  chmod -R 755 /Private/tmp/VoodooHDA.kext
  2⤵
  PID:508
- /usr/sbin/chown
  chown -R root:wheel /Private/tmp/VoodooHDA.kext
  2⤵
  PID:511
- /bin/Sleep
  Sleep 1
  2⤵
  PID:512
- /bin/cp
  cp -R /Private/tmp/VoodooHDA.kext /Library/Extensions/
  2⤵
  PID:515
- /bin/cp
  cp -R /Private/tmp/VoodooHDA.prefPane /Users/run/Library/PreferencePanes
  2⤵
  PID:516
- /usr/bin/touch
  touch //Library/Extensions/
  2⤵
  PID:517
- /bin/Sleep
  Sleep 5
  2⤵
  PID:518
- /bin/rm
  rm -rf /Private/tmp/VoodooHDA.kext
  2⤵
  PID:524
- /bin/rm
  rm -rf /Private/tmp/VoodooHDA.prefPane
  2⤵
  PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:514

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:514

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 172
1⤵
PID:527

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:527

/usr/sbin/kextcache
/usr/sbin/kextcache -F -u /
1⤵
PID:530

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:531

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:532

/usr/sbin/kextcache
kextcache -arch x86_64 -local-root -all-loaded -kernel /System/Library/Kernels/kernel -prelinked-kernel /Library/Apple/System/Library/PrelinkedKernels/prelinkedkernel -volume-root / /Library/Extensions /AppleInternal/Library/Extensions /Library/Apple/System/Library/Extensions /System/Library/Extensions
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:537

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:537

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.VoodooHDATahoe.bom

Path /Library/InstallerSandboxes/.PKInstallSandboxManager/990118B9-5039-4A00-9ABB-00E8B11B656B.activeSandbox/Boms/com.VoodooHDATahoe.bom
Size 60KB
SHA256 3a6575187bb3fb0497990bdc4ba41b764735b78a54ce8bfd5c7e3664bca38745
MD5 fff751775b321559b659745444898963
SHA1 38da328c2b35fe7e8b1d0848603c943ee6479ead
SHA512 a9fc2c1e0313731cb2abb8ec32b4cfb3715c7e89235fd07f623bd772a6a38fe5030ab548461582970248b27b455bfe6b152525d57586aaaee2bc3294d23b2b84
SSDEEP 96:xMHgdYohQ4IkeZY1mjcScjPXCWqdG87iMMpHxBe1G3kCWqdG87iMMpHxBe1G3:xMiSkiujPXedGRHV3d0edGRHV3d
TLSH
T1A1531F4737407C92C528093218FBFB846B15E3F4B7459FDF0C82825E8CD9A899F69A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._postinstall__

Path /Library/InstallerSandboxes/.PKInstallSandboxManager/990118B9-5039-4A00-9ABB-00E8B11B656B.activeSandbox/Scripts/com.VoodooHDATahoe.soOpr3//._postinstall__
Size 163B
SHA256 4c84d0e36607f904c18b0cd5f8512e3cc34e875c35403e86701a953d67119170
MD5 bf51db55cc16dbf6158674b8af16b297
SHA1 42e39c7e6a461c43d5a946214897648b5889694c
SHA512 67a32d5baeefe88194337d0f68f4f2ba2ff6fd4a5267e595c22275a4dea5bd3583ef4002836cc20fee10470923933c0f8285a3ba26126289f7f785cd5a452ed8
TLSH
T11DC012A459C0C2F0C49841340A833D57B3E4443491731622750D458407007106BA164A
MD5 SHA1 SHA512 TLSH

Submit Download

Info.plist

Path /Private/tmp/VoodooHDA.kext/Contents/Info.plist
Size 2KB
SHA256 6037b400a1224be3871cd519109b2dd3e5beecfdfda4b3ccb5610fc44aba67e8
MD5 b542b39437233c00705240ae1f7ef146
SHA1 ab349dbddec44e0ae507f85ef3abefa29fbb90b5
SHA512 16f24585ca259b23644da828da16df6467baccaec780dcae9cf2728419df9e2eacb21e9201d42a8d2f878fab4800b99763c800a9b64c0c2b94ccd06a5e03b5a2
TLSH
T13451BDF40F4C3ED81C8916610AD1950E00DE39DC5DB122FBAEC3C939BC59E46A2B49AA
MD5 SHA1 SHA512 TLSH

Submit Download

VoodooHDA

Path /Private/tmp/VoodooHDA.kext/Contents/MacOS/VoodooHDA
Size 247KB
SHA256 eebc409454c848af576a9f2ea16e7ce06ac136c4a30b22bf178c1f2028198474
MD5 421e90fe38eccc7a57f307958eda8b34
SHA1 3983b080da1ec0cfa9c0c784ec81eb60e3374d3e
SHA512 6f2ffb6b267ace9ebd3ad30e61976c97bf17999bbb77216f648d7f25158190e0e5e8342e0c3756b759c25d81b312b878f866ef83e49525c35b7385051e59cba9
SSDEEP 3072:lR+F295kcdYUiCbZD4Ein1EoSrm7rQHOl5zE2UodbqF1BA8jIvVaaMs:lR+FSS1n1zBrwBuqFDAzes
TLSH
T194343B2277C9A8FDDD8BD1705E524411EB30F9C20624EBD727C4E2341FB069DEA29B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CodeResources

Path /Private/tmp/VoodooHDA.kext/Contents/_CodeSignature/CodeResources
Size 2KB
SHA256 6686de10a28a2fe11b36cbb86dcbacc827cfc4ea116b4dabf1845e5aee629e9b
MD5 c48c1d9c6cf982c32580a9c58b0cce51
SHA1 630a08873072069616cdcc31f55e6d7423086d78
SHA512 27f6256579e03e319af66d7fa316935b4e2d5c126429a8b961424a466cab907ceab5d068fb87d763bc3d819a791492c17ab1d1b54f5530cb34224b582d00c013
TLSH
T17F415BF24E0C2EF6448C2E360756244F54EBFB869C7095328ED39472FA62B47A7811E9
MD5 SHA1 SHA512 TLSH

Submit Download

Info.plist

Path /Private/tmp/VoodooHDA.prefPane/Contents/Info.plist
Size 1KB
SHA256 4747332ef6b9ed5e385a343b1a4d7105b89a1f835ab00947eab81d66fdc88ee1
MD5 a9c06ecd70ec4a89813667fa3aa01557
SHA1 4f95a58d86a1c68ae9342292aa52dfcb72797439
SHA512 37d04a8a856c213499115a5f4357b2435da8004345a55ffaaee24e7c4596d119ff7c4fc81cf76c70763d230f6d2a638b218e64ff7b66a861969bfb8464ce1b8c
TLSH
T15121ADF51B18758C2CC216720AD2510E05E871CC5D3366FFFEC6A66CAD4E946A730AE2
MD5 SHA1 SHA512 TLSH

Submit Download

VoodooHDA

Path /Private/tmp/VoodooHDA.prefPane/Contents/MacOS/VoodooHDA
Size 73KB
SHA256 aa8f1e503ccbcc09f7c1d64fb23e6ebb2bd79582252c3165787caf9d2ce8568a
MD5 b5aa719d0a014b4bfafe8f588ad85200
SHA1 a2d45599b91d5426c7cf1ad6cc69734205d30c96
SHA512 2cac3da86f67390b8ce1b24b0b25bd181ef5f0061be246f75c3858ca29b37f3ef7558fe3ab45cc6780f41d19718dd840cadd7b4ea17ad77d6daf7aa590d16b29
SSDEEP 768:Skezfj/C7DJRyoPVrD7eI4Nk7lqSZRzHAV6vpm4q114q1ru8:Pev/CZRN9jeI4i/RUV6E4q114q1ru8
TLSH
T1C873E912771454F6CD898271C46F5336D1A8FA269833A96787C0E418DFF3BB20E466B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InfoPlist.strings

Path /Private/tmp/VoodooHDA.prefPane/Contents/Resources/English.lproj/InfoPlist.strings
Size 216B
SHA256 7d40d740b561f6a012a4ecde2826f55ba2bf3a88744f83b07ea5066e30eba1f6
MD5 fc36ca16624500c891e13b348e6d6ea4
SHA1 4f1ee849153bd2a200978ae06bc4255e3a2d24fd
SHA512 01ff45a6a13877c7cd0687e24ad98d04e13bf8ba207e166acbf8ba81684fbcbfb5722201cfc1a5da61e29126341135c41196b9dd2cac4214be77380c88a59f4d
TLSH
T1B7D01244AEF42518F1FB4F1468F150516DF9FD50AC36674D1151051E1670E80A524733
MD5 SHA1 SHA512 TLSH

Submit Download

VoodooHDAPref.nib

Path /Private/tmp/VoodooHDA.prefPane/Contents/Resources/English.lproj/VoodooHDAPref.nib
Size 28KB
SHA256 7b547e7dc9a2d22a06c7b44b85808b7469925999a67b52c65de290ca6c96d330
MD5 93178131fdcefc378a85aad475f18fb4
SHA1 219f669d6ab6ccb45718b501c1732c40da9d59d7
SHA512 2b6e863ed50ea12310ffc89e78072a76e1bba710723b98a196a2d3bdad9b0bb56bcd4139c300de43089aaef6d071e49ad9d32c8c9f1260de7c4d33387d2f7500
SSDEEP 768:i2Y6YzBw+6M7EwP4AvCC5e7VwwEcK6h2r0V/Wjbfv:NYNlw+rowP4ldBoOejbfv
TLSH
T139D21B5773D7EE14EBCB9D3CB12A2E32CB4904CB81F4975BC45658C2638821CF8E95A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoodooHDAPref.icns

Path /Private/tmp/VoodooHDA.prefPane/Contents/Resources/VoodooHDAPref.icns
Size 255KB
SHA256 7675cc5256bcb0d952821d0d2a7088ad6945236e4c5a4356d97f93de512c6b0a
MD5 791c760e7da114a36ac10b4c7bae401b
SHA1 719f63510a18edd936af6c2d4e4e50d1a399f145
SHA512 a4f7b4869b0a123208d528bea66e0176d2e480501a9f61be04ff2ffc50bfd7146316cb2a16447b9fdcbe40509790ddd00733b923bf00219c44f905e8edf78ae7
SSDEEP 6144:8Xj1FffWE+4Yiq+FklwhROLaDzBKEBuuTIMe1l:8X5JWEJoKhELO1KEBnHil
TLSH
T1C844F1658EA08940D9330E3C08E20724A2639FAD7E58E72E5C5579D7BDB32D1ECC919F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installd.commit.pid

Path /private/var/run/installd.commit.pid
Size 3B
SHA256 ba689abd93c9c6a7d08b5b5c04dd27f6d69755ebe9a87fb969e73dfc11660e38
MD5 b337e84de8752b27eda3a12363109e80
SHA1 300122350a32530a2c2103b46ed07eacdc82aff8
SHA512 59457d7de9887235a729ca8755b48b79a1139b0e66b5c238a01db22987b9c2d3ca478ba083d5788b3f7fcb1da6169a15d779439a990c7aa3d03ee03f51a4ccba
MD5 SHA1 SHA512

Submit Download

postinstall

Path /tmp/PKInstallSandbox.tkeu4d/Scripts/com.VoodooHDATahoe.soOpr3/postinstall
Size 425B
SHA256 28b58225fe276f91c5900dd70556a9194f491a9dca1d12e6d60b7f28f190b7b8
MD5 65a7f544daef6cd8cd3eabdcad05b399
SHA1 b8504c81d0f37f6d60a6f06beaf924247c82eaf7
SHA512 6f6a60e971ed23de92bff7174e0154e5223777f5ad3f8216f1c9ee2d87fb04ba5c6d53a6dee3411e9dfa96f3a6f869c634acf611213a66c4b009b8da6a46f950
TLSH
T149E0A0A823D8F09E48EE93B6EF51470ACDA0240913467D5367C68A7002122CC4C7AAAB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads