0aab08fe4d75dfdb2716c4f6f01153e39a5e02d2227500ef580df4f8cbe62b92

Resubmissions

01/05/2026, 16:58

260501-vg83eahz914

01/05/2026, 16:52

260501-vdwmxady5n4

01/05/2026, 16:51

260501-vc4l5ahz4w1

01/05/2026, 16:48

260501-va9qcshz3x4

Analysis

user interaction
yes
max time kernel
846s
max time network
893s
platform
macos-10.15_amd64
resource
macos-20250619-fr
resource tags

arch:amd64arch:i386image:macos-20250619-frkernel:19b77alocale:fr-fros:macos-10.15-amd64system
submitted
01/05/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
delta.dmg
Size 4.4MB
Sample260501-vg83eahz91
SHA256 0aab08fe4d75dfdb2716c4f6f01153e39a5e02d2227500ef580df4f8cbe62b92
MD5 d40a2200bc625ee7e42e4775446736c0
SHA1 1b1af5503f6336c536d1d4ee5012636074071fbb
SHA512 61e4f2756a763875c6cc91b68c225176a799381c8e2b32e154509606fae1a2f10fd1eb2a96073944812682b73c919faf743c4a30ba6d41aa874255d4d7a0c064
SSDEEP 98304:s8SMOLodAyYh2acePtdQMy58T9E+Y4/FxVN+tYBSwc+FcuDUp:stZLD2cPtdQV58xE/4xMtQSW
TLSH
T1AA2633FB0204D499F87784B51DFE18066E4F9C97BA27046CD4AA7C8632FA16DB4B240F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Delta\\ Installer/Delta\\ Installer.app\""
1⤵
PID:504

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Delta\\ Installer/Delta\\ Installer.app\""
1⤵
PID:504

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Delta\\ Installer/Delta\\ Installer.app"
1⤵
PID:504
- /bin/zsh
  /bin/zsh -c "open /Volumes/Delta\\ Installer/Delta\\ Installer.app"
  2⤵
  PID:505
- /usr/bin/open
  open "/Volumes/Delta Installer/Delta Installer.app"
  2⤵
  PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.E484B55B-453D-4052-BF7A-FBBC2FCECD80 512
1⤵
PID:513

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.openAndSavePanelService 287
1⤵
PID:522

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.QuickLookUIService 522
1⤵
PID:523

/System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
/System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.automountd
1⤵
PID:524

/usr/libexec/automountd
automountd
1⤵
PID:524
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:525
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:527

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:528

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:528

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:526

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:533

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:533

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook
1⤵
PID:534

/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.BB3C46D0-DA52-4467-A288-D59B752C55F7 534
1⤵
PID:535

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.TextEdit.2092
1⤵
PID:538

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:554

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.bsd.dirhelper
1⤵
PID:555

/usr/libexec/xpcproxy
xpcproxy com.apple.printtool.agent
1⤵
PID:556

/System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:560

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook
1⤵
PID:564

/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.1E06B87D-1F9B-46E2-B002-68CE44F56A90 564
1⤵
PID:565

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:566

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metadata.keychain-db

Path /Users/run/Library/Keychains/metadata.keychain-db
Size 23KB
SHA256 b525e5f8ad61be69469491eb17da29ae71b6c0cd9b961c551893ee208cbf573a
MD5 0718379645f994b2c44c99eca4245ff6
SHA1 ac2917947108decff767e4a9b4e367510b82674d
SHA512 8f21be1c4f43976e73df55929e20dcfff867e01b94fdec4f50a085da541dda0a006cf9f529a843b3b782ccb5ed6bf9a382ea8387e6230cefdc924e5c2e19c150
SSDEEP 192:Rz4o7VtY9RRrc2Neda+cDTfkGMv1RNhH3u:RvY9Lc24da+UTfg9RX3u
TLSH
T140B224412B559977CA940675F4F36B05BB7EE329E7470B0B2A82B0541C163D03EAEAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.keychain-db

Path /Users/run/Library/Keychains/metadata.keychain-db
Size 23KB
SHA256 8293bed3ac8330ca68dce415ae560bc6edccd353a9ea7bd1178d7fd69ad8c2e5
MD5 b78bf4ee172717a185a09aea1b3a4b99
SHA1 b82593fad424b8d1d65604028c5588c4abcc8ad6
SHA512 7b73184dad25306c395a5b18d4660b00f7487870b8ffe88c842c2f5c4ed8533df5532d8fed41b894720376924dc7f5363369fb20c472f704979a7cfc4f22b350
SSDEEP 192:Rz4o7VtY9RRrc2Neda+cDTfkGMv1RNhH6L2:RvY9Lc24da+UTfg9RX6L2
TLSH
T115B224412B559977CA940675F4F36B05BB7EE325E7470B0B2A82B0541C163D03EAEAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.keychain-db

Path /Users/run/Library/Keychains/metadata.keychain-db
Size 23KB
SHA256 7080ab5a3fac6f6cbcd7f1bd681f3279f38e976a32b01582be6682284193fd52
MD5 70e11e6a9456bcbd9e7aed4f0066664a
SHA1 207ff42ec94326bbb61f21680d654f85cdde6d7b
SHA512 405d67aaf55a549a8c3d27c0f83400c3f1238dab900218d658c0d31e88df78914aba7b98b775b5c61f5d846fd805afed295b60481a9ae02e662456f21d4e534d
SSDEEP 192:Rz4o7VtY9RRrc2Neda+cDTfkGMv1RNhHBx:RvY9Lc24da+UTfg9RXBx
TLSH
T1FAB214412B559977CA940675F4F36B05BB7EE329E7470B0B2A82B0541C163D03EAEAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Info.plist

Path /Volumes/Delta Installer/.TemporaryItems/folders.502/TemporaryItems/(En enregistrement par TextEdit)/Info.plist
Size 1KB
SHA256 968484e4217ba504c7466706b67af474a85edd499741ea3999143ce2898e6d94
MD5 f41fcbe79139b2e5d1d65784e021b7c0
SHA1 fe7a6d5a8e5a72da50cfbaa062cdfbda4e0ace78
SHA512 c326e135076ec2fee50d30b1ddc7097333273780b031c986da1955835bebe4e772f46c225463c269dfcf556f385e2eec4b8a7e26abcd9e8fd7e515f724603fc3
TLSH
T1C331E8F54B5C36992EC117774AC6510E01DC21CC5C3222FEFEC6A66CAE0EC06A375AE5
MD5 SHA1 SHA512 TLSH

Submit Download

Info.plist

Path /Volumes/Delta Installer/.TemporaryItems/folders.502/TemporaryItems/(En enregistrement par TextEdit)/Info.plist
Size 1KB
SHA256 1d42c0a63f5b15101d3d46beed916ccc36c375e50a4bfea8379aca17ffec54ff
MD5 49e3096543410236987e1a429cbeebd7
SHA1 05968a75a2846e0313b56dc967533d7f082f2a6b
SHA512 e600b6cd61bb14dfb11158b247e8a1f2d3638e72ce0a71873107771bb3519146eb4cad35307eb6296e0824ecd5f44fb809332795356c1b41dc6e91164feff2d9
TLSH
T16931E8F54B5C36992EC117774AC6510E01DC21CC5C3222FEFEC6A66CAE0EC06A375AE5
MD5 SHA1 SHA512 TLSH

Submit Download

Info.plist.sb-634744ce-sOceWM

Path /Volumes/Delta Installer/Delta Installer.app/Contents/Info.plist.sb-634744ce-sOceWM
Size 1KB
SHA256 0be454a1f6f74ee57a9eb6ef67807f998e2ff6f1d67167ed39da3f72ef4dab08
MD5 7f2a2a16858d9bfc5f5188e9b4ca47ef
SHA1 d0b8f98947f394c83245347b0521e7a80bd197a3
SHA512 d027b4cc41652f71c4f9caa4088cc359e422e1314bd47f54f507197793feb19516141010594af601ce4569e503cd4a53649d92dbb90c1333800a9b59f442d3c4
TLSH
T16C31E8F54B5C36992EC117774AC6510E01DC21CC5C3222FEFEC6A66CAE0EC06A375AE5
MD5 SHA1 SHA512 TLSH

Submit Download

tailspin-trace.2026-05-01_17-00-15.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-05-01_17-00-15.tailspin
Size 17.6MB
SHA256 8cb7b3c6cdc10e2c61917ff6a614095d4d99a46c1cf185de19a743287f54688e
MD5 50832e07332462a133af8fc52ce01d1c
SHA1 b74bc13e42cf77af630286a828a73448e5dc648a
SHA512 0fbef291be95732e94fc4cfd5956137f723e00cda5b1c93009891e521a976008cf05a37a17e79fc794f5169a8494efb503b932a3ba8a0d420b3304f37055e264
SSDEEP 196608:C4NER8JanslLus+3c02hpJlNQaNicvf+wEt5lCBOSYtxF4Xo3u0:tiSJmslLN+3cDHJldT2cLY94Xo3u0
TLSH
T1F307AE716CC6EE81CCC8B17A06D38EA617F372FAED9586BA00A55FC84456B120DC87D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 303KB
SHA256 464563f8aa29f7899dd7c296c1ff516a78514a6760bb783d70fb878288a8a418
MD5 1f7c80f0b2913607b0c9a84b1b67e844
SHA1 924e39db969f357f3e022bb9bc6934bb632492da
SHA512 472dc2f5032a7dca964ff19f1c1ef5364cf36aacf98c35efbcd4fa9f2cb2e00551368ec31410fffdf1b4c5c1b2c8b2ef1e0fad8205002ae62979f1d59449f9cc
SSDEEP 3072:pZiKxJkE0YitPDVCPsbdtZ+r7rbXswkJAyHFGIO4OXKI6jiScveq:lVXilGIO4OXKjyveq
TLSH
T1AB6462E0985816A0B1BE8293139B44110175E01FBCCA7D3D725EBA2C8F86537E7EF57A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 2.0MB
SHA256 e618c082fd1c454b81c9b2f1bdd5c73d88fb4a9071d5f37df637cf1189896726
MD5 706f0db1fafed835b08d95b974a39586
SHA1 0f45881807d019adc099c7b9fe99e3a97a6907ec
SHA512 3c1ba18b10dba2a52202a66d8007ad343fe83f91af973d1dbe6786a92d6eb32004bc91d8d29f6f2d0c0cc1a1aa930e98894aa2efaef1c556d1b2d9f31120be63
SSDEEP 12288:kVXmZoK6e1abM0nqPfs8lsE03lDqb85pjGG8NUn0WPwmUQoHG+ipWGXuYjdRANbv:6XmoK6ezmGjfqfS7YbM26ZFMMfPWkj
TLSH
T1269573E14CE805A071BAC093271B51014166E01FB8A63C3DF29EEB344F56A77E7EB979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads