Overview

overview

8

Static

static

3

Graillon-FREE-2.8.zip

windows10-2004-x64

1

Graillon-FREE-2.8.zip

windows11-ltsc_2024-x64

1

Graillon-F...de.pdf

windows10-2004-x64

3

Graillon-F...de.pdf

windows11-ltsc_2024-x64

3

Graillon-F...et.pdf

windows10-2004-x64

3

Graillon-F...et.pdf

windows11-ltsc_2024-x64

3

Graillon-F...on2.so

ubuntu-18.04-amd64

1

Graillon-F...st.ttl

windows10-2004-x64

3

Graillon-F...st.ttl

windows11-ltsc_2024-x64

3

Graillon-F...n 2.so

ubuntu-18.04-amd64

1

Graillon-F...n 2.so

ubuntu-18.04-amd64

1

Graillon-F....0.pkg

macos-10.15-amd64

4

Graillon-F....0.exe

windows10-2004-x64

4

Graillon-F....0.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...er.bmp

windows10-2004-x64

1

$PLUGINSDI...er.bmp

windows11-ltsc_2024-x64

1

$PROGRAMFI...ry.tfx

windows10-2004-x64

3

$PROGRAMFI...ry.tfx

windows11-ltsc_2024-x64

3

$PROGRAMFI...ry.tfx

windows10-2004-x64

3

$PROGRAMFI...ry.tfx

windows11-ltsc_2024-x64

3

$PROGRAMFI...ry.tfx

windows10-2004-x64

3

$PROGRAMFI...ry.tfx

windows11-ltsc_2024-x64

8

$PROGRAMFI...ry.tfx

windows10-2004-x64

3

$PROGRAMFI...ry.tfx

windows11-ltsc_2024-x64

3

$PROGRAMFI...ry.tfx

windows10-2004-x64

3

$PROGRAMFI...ry.tfx

windows11-ltsc_2024-x64

3

$PROGRAMFI...ry.tfx

windows10-2004-x64

3

$PROGRAMFI...ry.tfx

windows11-ltsc_2024-x64

3

$PROGRAMFI...ry.tfx

windows10-2004-x64

3

$PROGRAMFI...ry.tfx

windows11-ltsc_2024-x64

3

$PROGRAMFI...ry.tfx

windows10-2004-x64

3

$PROGRAMFI...ry.tfx

windows11-ltsc_2024-x64

3

Analysis

  • max time kernel
    71s
  • max time network
    104s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    20/06/2026, 03:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Graillon-FREE-2.8/Mac/Graillon-2-FREE-2.8.0.pkg
  • Size 12.7MB
  • Sample260620-dkl9daes4w
  • SHA256 d43d40e8a4d3a3dba7c64b06c85291e24b64d495b1e6bb7528208554b68775ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
defense_evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
    1⤵
      PID:480
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
      1⤵
        PID:480
      • /usr/bin/sudo
        sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
        1⤵
          PID:480
          • /bin/zsh
            /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
            2⤵
              PID:481
            • /usr/sbin/installer
              installer -pkg /Users/run/setup.pkg -target /
              2⤵
                PID:481
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.installd
              1⤵
                PID:502
              • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                1⤵
                  PID:502
                • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
                  /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
                  1⤵
                    PID:503
                  • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
                    /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/6972D65A-B8A4-48AC-9CBB-7E995C6D154E.activeSandbox/Root /
                    1⤵
                      PID:504
                    • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                      /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
                      1⤵
                        PID:505

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            com.auburnsounds.Graillon---aax.pkg.bom
                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/6972D65A-B8A4-48AC-9CBB-7E995C6D154E.activeSandbox/Boms/com.auburnsounds.Graillon---aax.pkg.bom
                            • Size 43KB
                            • SHA256 7aa9fb42348baeee06e548bd92aade4a7f1ea922a356d7d7dffe6de1995fcae9
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            com.auburnsounds.Graillon---au.pkg.bom
                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/6972D65A-B8A4-48AC-9CBB-7E995C6D154E.activeSandbox/Boms/com.auburnsounds.Graillon---au.pkg.bom
                            • Size 35KB
                            • SHA256 fd2add9aee4be899cf121d928ca38b78e216f4f946e55dc9505460fe49497ba2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            com.auburnsounds.Graillon---vst-.pkg.bom
                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/6972D65A-B8A4-48AC-9CBB-7E995C6D154E.activeSandbox/Boms/com.auburnsounds.Graillon---vst-.pkg.bom
                            • Size 35KB
                            • SHA256 bbd3965b1bf39a3a249bfa42229f30a5bcf12b5465b765e4517a12066f917ca6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            com.auburnsounds.Graillon---vst.pkg.bom
                            • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/6972D65A-B8A4-48AC-9CBB-7E995C6D154E.activeSandbox/Boms/com.auburnsounds.Graillon---vst.pkg.bom
                            • Size 35KB
                            • SHA256 2098ec52bcc17734f8b89bd4e62db185ba8984b48400953358d2504bd6b570f3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            installd.commit.pid
                            • Path /private/var/run/installd.commit.pid
                            • Size 3B
                            • SHA256 5344c4110f483793dc352c388e67776724c36b4bea3ffda6cab7c75b9c65aceb
                            • MD5 SHA1 SHA512
                            Submit Download