Overview
overview
4Static
static
1downloader_mac.dmg
macos-10.15-amd64
1Folx/Folx....Helper
macos-10.15-amd64
1Folx/Folx....S/Folx
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx....ension
macos-10.15-amd64
1Folx/Folx....ipt.js
windows10-2004-x64
3Folx/Folx....ipt.js
windows11-21h2-x64
3Folx/Folx....xAgent
macos-10.15-amd64
4Folx/Folx....ts.rtf
windows10-2004-x64
1Folx/Folx....ts.rtf
windows11-21h2-x64
1Folx/Folx....e-host
macos-10.15-amd64
4Folx/Folx....ow.ps1
windows10-2004-x64
3Folx/Folx....ow.ps1
windows11-21h2-x64
3Analysis
- max time kernel
80s - max time network
108s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
05/06/2026, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
downloader_mac.dmg
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
Folx/Folx.app/Contents/Library/LoginItems/FolxScheduleHelper.app/Contents/MacOS/FolxScheduleHelper
Resource
macos-20250619-en
Behavioral task
behavioral3
Sample
Folx/Folx.app/Contents/MacOS/Folx
Resource
macos-20250619-en
Behavioral task
behavioral4
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftAppKit.dylib
Resource
macos-20250619-en
Behavioral task
behavioral5
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCore.dylib
Resource
macos-20250619-en
Behavioral task
behavioral6
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreData.dylib
Resource
macos-20250619-en
Behavioral task
behavioral7
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreFoundation.dylib
Resource
macos-20250619-en
Behavioral task
behavioral8
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib
Resource
macos-20250619-en
Behavioral task
behavioral9
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreImage.dylib
Resource
macos-20250619-en
Behavioral task
behavioral10
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDarwin.dylib
Resource
macos-20250619-en
Behavioral task
behavioral11
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib
Resource
macos-20250619-en
Behavioral task
behavioral12
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib
Resource
macos-20250619-en
Behavioral task
behavioral13
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftIOKit.dylib
Resource
macos-20250619-en
Behavioral task
behavioral14
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib
Resource
macos-20250619-en
Behavioral task
behavioral15
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftObjectiveC.dylib
Resource
macos-20250619-en
Behavioral task
behavioral16
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftQuartzCore.dylib
Resource
macos-20250619-en
Behavioral task
behavioral17
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftSafariServices.dylib
Resource
macos-20250619-en
Behavioral task
behavioral18
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftXPC.dylib
Resource
macos-20250619-en
Behavioral task
behavioral19
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftos.dylib
Resource
macos-20250619-en
Behavioral task
behavioral20
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/MacOS/FolxSafariExtension
Resource
macos-20250619-en
Behavioral task
behavioral21
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win11-20260513-en
Behavioral task
behavioral23
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
Resource
macos-20250619-en
Behavioral task
behavioral24
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win11-20260513-en
Behavioral task
behavioral26
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/folx-chrome-host
Resource
macos-20250619-en
Behavioral task
behavioral27
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win11-20260513-en
General
- Target Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib
- Size 320KB
- Sample260605-wwfvvab16w
- SHA256 ea72aa5ceb84df4241827eb6eb75a83a22288cab1605348078f8a0cf7894e75e
- MD5 28271f5c8a9d6ed84ccd9e117c21b5fe
- SHA1 ebfdba0d0c25c5c2c347e688281b68a1f6ea3dbe
- SHA512 30e1885aa0dcdbb41fa3542e791d7b14c8cd98c7debb60339170fa566407a46475c7bf08a107713ab32adac54c0fedfad7f15ec862a4a27bc326ea339d30128f
- SSDEEP 3072:1o5uaLj93SCgAQ6DSEcKeeGkAgHujrJWbBZ7ohXs1bQm68p2:a5R9iqOEcKbAgHMWbBZ7oS1bXVp2
- TLSH T18064B6FAD2E64E24C434807883BF79221323F47193712768D764B2A56E7ED546E1FE0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib\""1⤵PID:507
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib\""1⤵PID:507
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib1⤵PID:507
-
/bin/zsh/bin/zsh -c /Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib2⤵PID:508
-
-
/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib2⤵PID:508
-