c5cb0221fae43b6e41d9125fa7b8c09253d63bca137b7c87f47e7381ad92dcfb

Resubmissions

17/05/2026, 09:43

260517-lqd4ysat4m

17/05/2026, 09:42

260517-lpjm2sat3q4

Analysis

user interaction
yes
max time kernel
36s
max time network
41s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
17/05/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
argon-addon.jar
Size 217KB
Sample260517-lpjm2sat3q
SHA256 c5cb0221fae43b6e41d9125fa7b8c09253d63bca137b7c87f47e7381ad92dcfb
MD5 d297b29f006f88b0ed7ba7a7c72ff027
SHA1 ee4381522293d6a909a3a2edf906ab0c2b4fc602
SHA512 0fcec2d31a85b49d890b6b18a4247c6e97b1efbeb5505274d49017d454201509799cdfc06bb1b2b67a08383a0a7f48880e0817e1945ab2a0e5ed05daa1044a21
SSDEEP 6144:8OP/YSm1112WSZc0dVWU+4ofdUMs6KH3fmJZhO:8wYSm11zSZBdVWUeO/H+Jq
TLSH
T1012402426FB9C02FE50755BEEA08C5D6287D5698948D581F28C827D90CE6CBB2F06FDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion execution

Malware Config

Signatures

JavaScript 1 TTPs 3 IoCs

Adversaries may abuse various implementations of JavaScript for execution.

execution

JavaScript

T1059.007

ioc	Process
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/argon-addon.jar	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/argon-addon.jar	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/argon-addon.jar	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Users/run/argon-addon.jar\""
1⤵
PID:487

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Users/run/argon-addon.jar\""
1⤵
PID:487

/usr/bin/sudo
sudo /bin/zsh -c "open /Users/run/argon-addon.jar"
1⤵
PID:487
- /bin/zsh
  /bin/zsh -c "open /Users/run/argon-addon.jar"
  2⤵
  PID:492
- /usr/bin/open
  open /Users/run/argon-addon.jar
  2⤵
  PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.JarLauncher.1532
1⤵
PID:496

/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
"/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
1⤵
PID:496
- /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
  "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/argon-addon.jar
  2⤵
  PID:501

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:500

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:524

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.JarLauncher.2128
1⤵
PID:525

/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
"/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
1⤵
PID:525
- /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
  "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/argon-addon.jar
  2⤵
  PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:527

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:528

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:529

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:530

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:531

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.JarLauncher.2128
1⤵
PID:533

/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher
"/System/Library/CoreServices/Jar Launcher.app/Contents/MacOS/Jar Launcher"
1⤵
PID:533
- /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
  "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -jar /Users/run/argon-addon.jar
  2⤵
  PID:534

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads