Overview
overview
6Static
static
6Payload/Wa...6.2.js
windows10-2004-x64
3Payload/Wa...6.2.js
windows11-21h2-x64
3Payload/Wa...s/cycc
ubuntu-18.04-amd64
1Payload/Wa...s/cycc
debian-9-armhf
1Payload/Wa...s/cycc
debian-9-mips
1Payload/Wa...s/cycc
debian-9-mipsel
1Payload/Wa...ynject
macos-10.15-amd64
1Payload/Wa....dylib
macos-10.15-amd64
1Payload/Wa....dylib
macos-10.15-amd64
1Payload/Wa....dylib
macos-10.15-amd64
1Payload/Wa....dylib
macos-10.15-amd64
1Payload/Wa...ts.pdf
windows10-2004-x64
3Payload/Wa...ts.pdf
windows11-21h2-x64
3Payload/Wa...d.html
windows10-2004-x64
3Payload/Wa...d.html
windows11-21h2-x64
4Payload/Wa...aid.js
windows10-2004-x64
3Payload/Wa...aid.js
windows11-21h2-x64
3Payload/Wa...aid.js
windows10-2004-x64
3Payload/Wa...aid.js
windows11-21h2-x64
3Payload/Wa...d.html
windows10-2004-x64
4Payload/Wa...d.html
windows11-21h2-x64
4Payload/Wa...aid.js
windows10-2004-x64
3Payload/Wa...aid.js
windows11-21h2-x64
3Payload/Wa...-v1.js
windows10-2004-x64
3Payload/Wa...-v1.js
windows11-21h2-x64
3Payload/Wa...-v1.js
windows10-2004-x64
3Payload/Wa...-v1.js
windows11-21h2-x64
3Payload/Wa...-v1.js
windows10-2004-x64
3Payload/Wa...-v1.js
windows11-21h2-x64
3Payload/Wa...ts.pdf
windows10-2004-x64
3Payload/Wa...ts.pdf
windows11-21h2-x64
3Payload/Wa....dylib
macos-10.15-amd64
1Analysis
- max time kernel
132s - max time network
141s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
30/05/2026, 04:29
Behavioral task
behavioral1
Sample
Payload/Warriors.app/Frameworks/AppLovinSDK.framework/AppLovinSDKResources.bundle/omsdk-v1.6.2.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Payload/Warriors.app/Frameworks/AppLovinSDK.framework/AppLovinSDKResources.bundle/omsdk-v1.6.2.js
Resource
win11-20260513-en
Behavioral task
behavioral3
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Commands/cycc
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral4
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Commands/cycc
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral5
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Commands/cycc
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral6
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Commands/cycc
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral7
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Commands/cynject
Resource
macos-20250619-en
Behavioral task
behavioral8
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateBootstrap.dylib
Resource
macos-20250619-en
Behavioral task
behavioral9
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateInjection.dylib
Resource
macos-20250619-en
Behavioral task
behavioral10
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateLauncher.dylib
Resource
macos-20250619-en
Behavioral task
behavioral11
Sample
Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateLoader.dylib
Resource
macos-20250619-en
Behavioral task
behavioral12
Sample
Payload/Warriors.app/Frameworks/MolocoSDK.framework/Assets.pdf
Resource
win10v2004-20260513-en
Behavioral task
behavioral13
Sample
Payload/Warriors.app/Frameworks/MolocoSDK.framework/Assets.pdf
Resource
win11-20260513-en
Behavioral task
behavioral14
Sample
Payload/Warriors.app/Frameworks/MolocoSDK.framework/Resources.bundle/endcard.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral15
Sample
Payload/Warriors.app/Frameworks/MolocoSDK.framework/Resources.bundle/endcard.html
Resource
win11-20260513-en
Behavioral task
behavioral16
Sample
Payload/Warriors.app/Frameworks/MolocoSDK.framework/mraid.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral17
Sample
Payload/Warriors.app/Frameworks/MolocoSDK.framework/mraid.js
Resource
win11-20260513-en
Behavioral task
behavioral18
Sample
Payload/Warriors.app/Frameworks/NeftaSDK.framework/mraid.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral19
Sample
Payload/Warriors.app/Frameworks/NeftaSDK.framework/mraid.js
Resource
win11-20260513-en
Behavioral task
behavioral20
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/MolocoSDK.bundle/Resources.bundle/endcard.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral21
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/MolocoSDK.bundle/Resources.bundle/endcard.html
Resource
win11-20260513-en
Behavioral task
behavioral22
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/MolocoSDK.bundle/mraid.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral23
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/MolocoSDK.bundle/mraid.js
Resource
win11-20260513-en
Behavioral task
behavioral24
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/PAGAdSDK.bundle/omsdk-v1.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/PAGAdSDK.bundle/omsdk-v1.js
Resource
win11-20260513-en
Behavioral task
behavioral26
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/UnityAdsResources.bundle/omid-session-client-v1.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral27
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/UnityAdsResources.bundle/omid-session-client-v1.js
Resource
win11-20260513-en
Behavioral task
behavioral28
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/UnityAdsResources.bundle/omsdk-v1.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral29
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/UnityAdsResources.bundle/omsdk-v1.js
Resource
win11-20260513-en
Behavioral task
behavioral30
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/UsercentricsUIResources.bundle/Assets.pdf
Resource
win10v2004-20260513-en
Behavioral task
behavioral31
Sample
Payload/Warriors.app/Frameworks/UnityFramework.framework/UsercentricsUIResources.bundle/Assets.pdf
Resource
win11-20260513-en
Behavioral task
behavioral32
Sample
Payload/Warriors.app/Frameworks/WeAreWarriors.dylib
Resource
macos-20250619-en
General
- Target Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateBootstrap.dylib
- Size 96KB
- Sample260530-e4f25sfz7m
- SHA256 a717a4729dec9a804c6c36e12ba874dc153cebccaea34423ab18fec376cef720
- MD5 6fedcffddfb05c315c4b45ba648aa14a
- SHA1 e74ca8f6bdb665a4a502dce01b30776d83e31e41
- SHA512 511e91e1544862da4533e144e24b19a73340bf06b981b915c59fedcfae242bae6a56f60dd239d71ce14bb420da1a072a6e892e032e4d01bf23552069ec36c2aa
- SSDEEP 48:A310VOUmtn2aqs6X5X5XSl2VSM6Ky6QQrWYqIQMXKUoksrsX8q06TlBM6KkulyW7:WGaEpXpVgvxQN5QMCGBlYlJaU
- TLSH T197A33347EB9C5B99D86C02B481D753893272F4703B93862A0B85C1286F727A5387E78B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateBootstrap.dylib\""1⤵PID:483
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateBootstrap.dylib\""1⤵PID:483
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateBootstrap.dylib1⤵PID:483
-
/bin/zsh/bin/zsh -c /Users/run/Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateBootstrap.dylib2⤵PID:484
-
-
/Users/run/Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateBootstrap.dylib/Users/run/Payload/Warriors.app/Frameworks/CydiaSubstrate.framework/Libraries/SubstrateBootstrap.dylib2⤵PID:484
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵PID:496
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵PID:496
-
/usr/libexec/xpcproxyxpcproxy com.apple.StreamingUnzipService 1971⤵PID:497
-
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService1⤵PID:497