Overview
overview
4Static
static
1downloader_mac.dmg
macos-10.15-amd64
1Folx/Folx....Helper
macos-10.15-amd64
1Folx/Folx....S/Folx
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx....ension
macos-10.15-amd64
1Folx/Folx....ipt.js
windows10-2004-x64
3Folx/Folx....ipt.js
windows11-21h2-x64
3Folx/Folx....xAgent
macos-10.15-amd64
4Folx/Folx....ts.rtf
windows10-2004-x64
1Folx/Folx....ts.rtf
windows11-21h2-x64
1Folx/Folx....e-host
macos-10.15-amd64
4Folx/Folx....ow.ps1
windows10-2004-x64
3Folx/Folx....ow.ps1
windows11-21h2-x64
3Analysis
- max time kernel
91s - max time network
106s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
05/06/2026, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
downloader_mac.dmg
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
Folx/Folx.app/Contents/Library/LoginItems/FolxScheduleHelper.app/Contents/MacOS/FolxScheduleHelper
Resource
macos-20250619-en
Behavioral task
behavioral3
Sample
Folx/Folx.app/Contents/MacOS/Folx
Resource
macos-20250619-en
Behavioral task
behavioral4
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftAppKit.dylib
Resource
macos-20250619-en
Behavioral task
behavioral5
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCore.dylib
Resource
macos-20250619-en
Behavioral task
behavioral6
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreData.dylib
Resource
macos-20250619-en
Behavioral task
behavioral7
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreFoundation.dylib
Resource
macos-20250619-en
Behavioral task
behavioral8
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib
Resource
macos-20250619-en
Behavioral task
behavioral9
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreImage.dylib
Resource
macos-20250619-en
Behavioral task
behavioral10
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDarwin.dylib
Resource
macos-20250619-en
Behavioral task
behavioral11
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib
Resource
macos-20250619-en
Behavioral task
behavioral12
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib
Resource
macos-20250619-en
Behavioral task
behavioral13
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftIOKit.dylib
Resource
macos-20250619-en
Behavioral task
behavioral14
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib
Resource
macos-20250619-en
Behavioral task
behavioral15
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftObjectiveC.dylib
Resource
macos-20250619-en
Behavioral task
behavioral16
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftQuartzCore.dylib
Resource
macos-20250619-en
Behavioral task
behavioral17
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftSafariServices.dylib
Resource
macos-20250619-en
Behavioral task
behavioral18
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftXPC.dylib
Resource
macos-20250619-en
Behavioral task
behavioral19
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftos.dylib
Resource
macos-20250619-en
Behavioral task
behavioral20
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/MacOS/FolxSafariExtension
Resource
macos-20250619-en
Behavioral task
behavioral21
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win11-20260513-en
Behavioral task
behavioral23
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
Resource
macos-20250619-en
Behavioral task
behavioral24
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win11-20260513-en
Behavioral task
behavioral26
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/folx-chrome-host
Resource
macos-20250619-en
Behavioral task
behavioral27
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win11-20260513-en
General
- Target Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib
- Size 83KB
- Sample260605-wwfvvab16w
- SHA256 d7cddda85fd12d875136c1a374c5bca76156f4139db46ce699f33c3b22472e60
- MD5 b6d97d38a44dbff92a217cf22996532a
- SHA1 cab3bfd0f5237bcc8b0eb4b4e060f2a80d7992b2
- SHA512 73ec4cf138c2af59dcbdd6ea34fffabbfb0972bce3bc803094ce6517d0a5ce80d514bd705d2c43996a90c9e78545886450c7e443f833cbaa95b13ad7fe175d2f
- SSDEEP 768:/Lbjr+chkNwxGlsMg/Knbekt+9PPGFP2Eg8eJEEPab8X:HjrDkNwxGlsMgybekt+9PWuEgXJEEPK
- TLSH T1A7831A832A547421CD6C517641DF2A832931B782BE12566FB3D187E65F33F8A34239EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib\""1⤵PID:496
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib\""1⤵PID:496
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib1⤵PID:496
-
/bin/zsh/bin/zsh -c /Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib2⤵PID:497
-
-
/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib2⤵PID:497
-