9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034

Analysis

max time kernel
351s
max time network
521s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
08/05/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1
Size 3KB
Sample260508-bf2gdsfy2p
SHA256 9c8123d21cc9f089eede2c81be5d44ab05ce60f83b48966344f6f697330d1034
MD5 dec84b4f7859e44892e0750c83fd693d
SHA1 6f88920515398ca40a09ec06dd2e2a61d2c60583
SHA512 759c6f7c79a6754190848d311ed263e708c1ac791684586228aee63560c8134c310d4433c365d6543b261ffbde7777da63cc69269e22d58d2464ccc6e51ec067
TLSH
T1DB617072B75ED26542761EB8B5C68484F915E82B30A46420B2BC84EE6F3C330D1FAC69
MD5 SHA1 SHA512 TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 3 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1\""	Process not Found
sudo /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1"	Process not Found
/bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1\""
1⤵
PID:483

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1\""
1⤵
PID:483

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1"
1⤵
PID:483
- /bin/zsh
  /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1"
  2⤵
  PID:484

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:496

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 197
1⤵
PID:499

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:509

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:509

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads