45eabe2c5ff70adbde4966a89033dca0f11072195fbff6aba26287a843373109

Analysis

max time kernel
83s
max time network
107s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
05/06/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
Size 110KB
Sample260605-wwfvvab16w
SHA256 45eabe2c5ff70adbde4966a89033dca0f11072195fbff6aba26287a843373109
MD5 dc1eccfccc186ba809eee3c5098e20a8
SHA1 fd61f13bbfd2ea974a3e3025a4081d493ee018fb
SHA512 dc3cc7ae231fdf451fa3539b3da13035b33456af3377f9b95f1fdd013a9b42961b6f4994d33f1415ae8054f96ad3a9acd87d773f52fde03755711ede4052518a
SSDEEP 1536:gnpbQlQJjNBzccOVjmLsvj1J5Q2fYk32GIIVV0JeyrtNSXJEbPK:ejNacAZvQIYk32GIIVVXsNK0P
TLSH
T1E9B318972760548FD8D9E539C2BF970782A0FDEA6E28B20E42D141496FE0DF16642F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
sudo /bin/zsh -c /Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent	Process not Found
/bin/zsh -c /Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent	Process not Found
/Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent	Process not Found
sh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent\""
1⤵
PID:471

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent\""
1⤵
PID:471

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
1⤵
PID:471
- /bin/zsh
  /bin/zsh -c /Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
  2⤵
  PID:481
- /Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
  /Users/run/Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
  2⤵
  PID:481

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000001.Folx
1⤵
PID:482

/Users/run/Folx/Folx.app/Contents/MacOS/Folx
/Users/run/Folx/Folx.app/Contents/MacOS/Folx ActivateFolxAgentNotification
1⤵
PID:482

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:490

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:490

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 198
1⤵
PID:491

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:491

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Info.plist

Path /private/var/root/Library/Internet Plug-Ins/Folx3Plugin.plugin/Contents/Info.plist
Size 20KB
SHA256 bc7fa22a631f11797015a91bedbab92e1f1abd7e6bea17b52d95a21a6fe4a0f2
MD5 db7362c42e16df641c5d0dfbb73bfb7b
SHA1 02c9e1d5cea95c623fba4e38e2ddf8282e92b92b
SHA512 25ea03e9c6abd10510dd0e5875523139b66275b188a31a36c91305c2baef4892622b1c7229e1fe869beb9e8097a24c1977b004cf4f77057979fdab3e324bdfb7
SSDEEP 96:CyUtqQHYCTHNHcWI0g4V6SPceScMW1+vF8vQvU0bAvfsQaQGt+otm0MXi6hKpMnQ:XA4At61Y2wf7R/DoTlTl04
TLSH
T1C09231F01E0D3DBD4CE816224FE4758E24DF7E889C3880B6B9F74525B905F06A5F8A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download