d8538fcfd4cc94f158d155bbde491e82f358a67c117eb721ddc6a96d5521159b

Analysis

max time kernel
474s
max time network
599s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
08/05/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.bat
Size 578B
Sample260508-bf2gdsfy2p
SHA256 d8538fcfd4cc94f158d155bbde491e82f358a67c117eb721ddc6a96d5521159b
MD5 7536ea63e6007a4a3c0c6648a9e6ae00
SHA1 46c02f9fe1ff85f9c597ca82a6cd2ee39a19c787
SHA512 01cd0240b03a6e3ad2c4463a18fbe26aab4c08c1a52503a0c8ccede97ffa4e7088e0f9fb6b1a658c4b1e7dac30e96fc7add53369ed9131d561e4d59487453bd4
TLSH
T10CF0A2D7244D913848402685B67E94DDF35443F23639A5542E077C53B31948A974DF70
MD5 SHA1 SHA512 TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 3 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.bat"	Process not Found
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.bat\""	Process not Found
sudo /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.bat"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.bat\""
1⤵
PID:500

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.bat\""
1⤵
PID:500

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.bat"
1⤵
PID:500
- /bin/zsh
  /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.bat"
  2⤵
  PID:501

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:502

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:502

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:520

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:531

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:532

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:537

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:538

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:538

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads