f1c14613aa90c10def4ca7238329270871997eb26f919f7074dc25533e3e75dd

Analysis

max time kernel
477s
max time network
906s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
08/05/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node-pty/lib/eventEmitter2.js
Size 1KB
Sample260508-bf2gdsfy2p
SHA256 f1c14613aa90c10def4ca7238329270871997eb26f919f7074dc25533e3e75dd
MD5 1c7c2a107991b0a0f26a07c56fc7819e
SHA1 4a49eee04288c57afe2f09ce37563c82aee450f1
SHA512 93529d7d25bffddd1cffbe8060b310470b8dba533aeb3c6edb5ed56eaabe9ed749f29e444f935a1255c4becfb892f49aa0433067d16c6352195ef31b305be904
TLSH
T14F31288C8DFA18A56196B1BF5B1F9049B0A4C2832019DD15BF1CEBDC5F1FC2891D0DA8
MD5 SHA1 SHA512 TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 3 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node-pty/lib/eventEmitter2.js\""	Process not Found
sudo /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node-pty/lib/eventEmitter2.js"	Process not Found
/bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node-pty/lib/eventEmitter2.js"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node-pty/lib/eventEmitter2.js\""
1⤵
PID:479

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node-pty/lib/eventEmitter2.js\""
1⤵
PID:479

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node-pty/lib/eventEmitter2.js"
1⤵
PID:479
- /bin/zsh
  /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node-pty/lib/eventEmitter2.js"
  2⤵
  PID:480

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:494

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:494

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 195
1⤵
PID:495

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:495

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:506

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:507

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:507

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:508

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads