Overview
overview
4Static
static
1downloader_mac.dmg
macos-10.15-amd64
1Folx/Folx....Helper
macos-10.15-amd64
1Folx/Folx....S/Folx
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx.....dylib
macos-10.15-amd64
1Folx/Folx....ension
macos-10.15-amd64
1Folx/Folx....ipt.js
windows10-2004-x64
3Folx/Folx....ipt.js
windows11-21h2-x64
3Folx/Folx....xAgent
macos-10.15-amd64
4Folx/Folx....ts.rtf
windows10-2004-x64
1Folx/Folx....ts.rtf
windows11-21h2-x64
1Folx/Folx....e-host
macos-10.15-amd64
4Folx/Folx....ow.ps1
windows10-2004-x64
3Folx/Folx....ow.ps1
windows11-21h2-x64
3Analysis
- max time kernel
119s - max time network
137s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
05/06/2026, 18:16
Static task
static1
Behavioral task
behavioral1
Sample
downloader_mac.dmg
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
Folx/Folx.app/Contents/Library/LoginItems/FolxScheduleHelper.app/Contents/MacOS/FolxScheduleHelper
Resource
macos-20250619-en
Behavioral task
behavioral3
Sample
Folx/Folx.app/Contents/MacOS/Folx
Resource
macos-20250619-en
Behavioral task
behavioral4
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftAppKit.dylib
Resource
macos-20250619-en
Behavioral task
behavioral5
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCore.dylib
Resource
macos-20250619-en
Behavioral task
behavioral6
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreData.dylib
Resource
macos-20250619-en
Behavioral task
behavioral7
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreFoundation.dylib
Resource
macos-20250619-en
Behavioral task
behavioral8
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib
Resource
macos-20250619-en
Behavioral task
behavioral9
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreImage.dylib
Resource
macos-20250619-en
Behavioral task
behavioral10
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDarwin.dylib
Resource
macos-20250619-en
Behavioral task
behavioral11
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftDispatch.dylib
Resource
macos-20250619-en
Behavioral task
behavioral12
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftFoundation.dylib
Resource
macos-20250619-en
Behavioral task
behavioral13
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftIOKit.dylib
Resource
macos-20250619-en
Behavioral task
behavioral14
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftMetal.dylib
Resource
macos-20250619-en
Behavioral task
behavioral15
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftObjectiveC.dylib
Resource
macos-20250619-en
Behavioral task
behavioral16
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftQuartzCore.dylib
Resource
macos-20250619-en
Behavioral task
behavioral17
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftSafariServices.dylib
Resource
macos-20250619-en
Behavioral task
behavioral18
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftXPC.dylib
Resource
macos-20250619-en
Behavioral task
behavioral19
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftos.dylib
Resource
macos-20250619-en
Behavioral task
behavioral20
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/MacOS/FolxSafariExtension
Resource
macos-20250619-en
Behavioral task
behavioral21
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Resources/script.js
Resource
win11-20260513-en
Behavioral task
behavioral23
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/MacOS/FolxAgent
Resource
macos-20250619-en
Behavioral task
behavioral24
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/en.lproj/Credits.rtf
Resource
win11-20260513-en
Behavioral task
behavioral26
Sample
Folx/Folx.app/Contents/Resources/FolxAgent.app/Contents/Resources/folx-chrome-host
Resource
macos-20250619-en
Behavioral task
behavioral27
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
Folx/Folx.app/Contents/Resources/FolxRegWindow.ps1
Resource
win11-20260513-en
General
- Target Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib
- Size 186KB
- Sample260605-wwfvvab16w
- SHA256 7b23914a83ac9931661115a4fa0d2c3db138ffe8c029629a126d937ad03408e1
- MD5 a3f59112254970f406415906014d208f
- SHA1 21e558dba059a3378ec73efa03ce84539d88d71e
- SHA512 a42d75eaa70ffc8bbdd926c2f3ca37ed3480fb411b1b8342b843eccade5c74f2630a4223df7b9e99f4895d6c29e7e86d18ebbee15a5e99fe2f0787c9846b10ec
- SSDEEP 3072:2a1kZDjzHXI9TH85JojH4bLQfWXO6sI9Zr6vzEOMbOYaoP:H1kJvHXD5LDAyIU
- TLSH T14714D55BF6622C5CCC6DC8704E9E26513015FDF827A24B5EABF050357A66E306E12BCE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib\""1⤵PID:499
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib\""1⤵PID:499
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib1⤵PID:499
-
/bin/zsh/bin/zsh -c /Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib2⤵PID:500
-
-
/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib/Users/run/Folx/Folx.app/Contents/PlugIns/FolxSafariExtension.appex/Contents/Frameworks/libswiftCoreGraphics.dylib2⤵PID:500
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵PID:501
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵PID:501
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:520
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:520
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:524
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:525