Overview
overview
4Static
static
1downloader_mac.dmg
macos-10.15-amd64
1Folx/Folx....Helper
macos-10.15-amd64
1Folx/Folx....S/Folx
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx....ension
macos-10.15-amd64
1Folx/Folx....ipt.js
windows10-2004-x64
3Folx/Folx....ipt.js
windows11-21h2-x64
3Folx/Folx....xAgent
macos-10.15-amd64
4Folx/Folx....ts.rtf
windows10-2004-x64
1Folx/Folx....ts.rtf
windows11-21h2-x64
1Folx/Folx....e-host
macos-10.15-amd64
4Folx/Folx....ow.ps1
windows10-2004-x64
3Folx/Folx....ow.ps1
windows11-21h2-x64
3Analysis
- max time kernel
90s - max time network
106s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
05/06/2026, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
downloader_mac.dmg
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral2
Sample
Folx/Folx.app/Contents/Library/LoginItems/FolxScheduleHelper.app/Contents/MacOS/FolxScheduleHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral3
Sample
Folx/Folx.app/Contents/MacOS/Folx
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral4
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftAppKit.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral5
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCore.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral6
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreData.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreFoundation.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral8
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral9
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreImage.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral10
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDarwin.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral11
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral12
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral13
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftIOKit.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral14
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral15
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftObjectiveC.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral16
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftQuartzCore.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral17
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftSafariServices.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral18
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftXPC.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral19
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftos.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral20
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/MacOS/FolxSafariExtension
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral21
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral24
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/folx-chrome-host
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral27
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win11-20260513-en
windows11-21h2-x64
General
- Target Folx/Folx.app/Contents/MacOS/Folx
- Size 7.3MB
- Sample260605-wwfvvab16w
- SHA256 ec01e1d780839170e491769f70dcd37e8684257148e5811cf52bcb39d0fd4389
- MD5 4c7c80560c49685b21debbe2423489b2
- SHA1 e8501161fce95f27d053a44292105882b7bcd2e3
- SHA512 272b1059d6fd2ce7053dbf0986fa92f299368a35d725db2e7e436f3934d97957e8fca70310ed492563c25ffebc399e8b067a3178f7e13201fbbef40837fb6a3d
- SSDEEP 98304:y8kkI/9D/giTsufaPblm5xg6DKQx1eDeynrQTqsGa+QiMgKMaGbGbQyFOXXAFj:y8kkI/FgiTsukkKu1UeRqsGaobG9
- TLSH T116765C3B66A0811DC096D13057AF87329B70F8E62A257A0F17D0A7263FF5CE06B9D746
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/MacOS/Folx\""1⤵PID:476
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/MacOS/Folx\""1⤵PID:476
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Folx/Folx.app/Contents/MacOS/Folx1⤵PID:476
-
/bin/zsh/bin/zsh -c /Users/run/Folx/Folx.app/Contents/MacOS/Folx2⤵PID:477
-
-
/Users/run/Folx/Folx.app/Contents/MacOS/Folx/Users/run/Folx/Folx.app/Contents/MacOS/Folx2⤵PID:477
-