Overview
overview
4Static
static
1downloader_mac.dmg
macos-10.15-amd64
1Folx/Folx....Helper
macos-10.15-amd64
1Folx/Folx....S/Folx
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx....ension
macos-10.15-amd64
1Folx/Folx....ipt.js
windows10-2004-x64
3Folx/Folx....ipt.js
windows11-21h2-x64
3Folx/Folx....xAgent
macos-10.15-amd64
4Folx/Folx....ts.rtf
windows10-2004-x64
1Folx/Folx....ts.rtf
windows11-21h2-x64
1Folx/Folx....e-host
macos-10.15-amd64
4Folx/Folx....ow.ps1
windows10-2004-x64
3Folx/Folx....ow.ps1
windows11-21h2-x64
3Analysis
- max time kernel
90s - max time network
114s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
05/06/2026, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
downloader_mac.dmg
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
Folx/Folx.app/Contents/Library/LoginItems/FolxScheduleHelper.app/Contents/MacOS/FolxScheduleHelper
Resource
macos-20250619-en
Behavioral task
behavioral3
Sample
Folx/Folx.app/Contents/MacOS/Folx
Resource
macos-20250619-en
Behavioral task
behavioral4
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftAppKit.dylib
Resource
macos-20250619-en
Behavioral task
behavioral5
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCore.dylib
Resource
macos-20250619-en
Behavioral task
behavioral6
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreData.dylib
Resource
macos-20250619-en
Behavioral task
behavioral7
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreFoundation.dylib
Resource
macos-20250619-en
Behavioral task
behavioral8
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib
Resource
macos-20250619-en
Behavioral task
behavioral9
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreImage.dylib
Resource
macos-20250619-en
Behavioral task
behavioral10
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDarwin.dylib
Resource
macos-20250619-en
Behavioral task
behavioral11
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib
Resource
macos-20250619-en
Behavioral task
behavioral12
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib
Resource
macos-20250619-en
Behavioral task
behavioral13
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftIOKit.dylib
Resource
macos-20250619-en
Behavioral task
behavioral14
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib
Resource
macos-20250619-en
Behavioral task
behavioral15
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftObjectiveC.dylib
Resource
macos-20250619-en
Behavioral task
behavioral16
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftQuartzCore.dylib
Resource
macos-20250619-en
Behavioral task
behavioral17
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftSafariServices.dylib
Resource
macos-20250619-en
Behavioral task
behavioral18
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftXPC.dylib
Resource
macos-20250619-en
Behavioral task
behavioral19
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftos.dylib
Resource
macos-20250619-en
Behavioral task
behavioral20
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/MacOS/FolxSafariExtension
Resource
macos-20250619-en
Behavioral task
behavioral21
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win11-20260513-en
Behavioral task
behavioral23
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
Resource
macos-20250619-en
Behavioral task
behavioral24
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win11-20260513-en
Behavioral task
behavioral26
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/folx-chrome-host
Resource
macos-20250619-en
Behavioral task
behavioral27
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win11-20260513-en
General
- Target Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib
- Size 3.0MB
- Sample260605-wwfvvab16w
- SHA256 8efbd3f068ee7d44dc130ea07bc42011c3ed31953d8f524e8b045165e7cbb27e
- MD5 2ae424a71e4b7a0d812b27c9b4cee611
- SHA1 f8f23efa7b25dad4122552d00e9bb6b32119a872
- SHA512 0b635026a7890b09815e5ec408f1b787c64ef04c400927d68db0a3c4e5f2b2060c4826eec0f1df56550ef58ebcc03d2be7f6178eb6889486279d24ec5cf1ab73
- SSDEEP 49152:XwCROS1cNS83nxZXwcK9+EHdD7/26iN4LQy5gWwUGnnWEe+mgVL00cBPOtaFlIHw:gCd1cNn4p/X0fVYtBGt1GK3
- TLSH T1B7E5386B9F33A81CC17F807215BF69502530FB97B8523DFAE3945B741BE9861178A20E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib\""1⤵PID:494
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib\""1⤵PID:494
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib1⤵PID:494
-
/bin/zsh/bin/zsh -c /Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib2⤵PID:495
-
-
/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib2⤵PID:495
-