890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60

Analysis

max time kernel
351s
max time network
854s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
08/05/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1
Size 1KB
Sample260508-bf2gdsfy2p
SHA256 890232e9863e6c955755c5a331f1e2b637e18c985ff2dc6edb65309493919b60
MD5 d0568512a8b58a101d43c7c961ad50d0
SHA1 66654847c09efaf9edef7d74fdded9716db5e0f6
SHA512 ebb7f760416ce47629b6ac790ebe9d8e1c2173d21efe24cdf556ec9c031f961263809d9401a049410c6fe510495a4aa8bcb732f5beda12da2e5011e8abb5e184
TLSH
T12741FD617EC1E2B401B191329EE39759F10A046B6570292074FDD219FF345A7C9FEDC8
MD5 SHA1 SHA512 TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 3 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
sudo /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1"	Process not Found
/bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1"	Process not Found
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1\""
1⤵
PID:478

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1\""
1⤵
PID:478

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1"
1⤵
PID:478
- /bin/zsh
  /bin/zsh -c "/Users/run/Install stagewise/stagewise (Pre-Release).app/Contents/Resources/app.asar.unpacked/node_modules/node.ps1"
  2⤵
  PID:479

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:510

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 186
1⤵
PID:513

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:514

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:514

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:515

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:531

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:531

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads