ab72fb3920963b0a5c16d09bf104a30993de366cad9e33f96cf4c18dfd6c7ed0

Analysis

user interaction
yes
max time kernel
73s
max time network
80s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/07/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
qbittorrent-5.2.2_lt20.dmg
Size 47.0MB
Sample260702-cc71faaz2x
SHA256 ab72fb3920963b0a5c16d09bf104a30993de366cad9e33f96cf4c18dfd6c7ed0
MD5 e6a608943fee23da0423dc0d1a02af22
SHA1 269664ac3ee53499694a708d062b8cc236bfb098
SHA512 306cbfaf23b9369758463f4dd02c1c05f4dc3c82ab5d021d2e7aace72994dbc1050274088419e00398a37e124af4c71aaf22879db4fb23166e1aa5f05ab1e9b3
SSDEEP 786432:8l6z2YD3mKGje/XIYVvvjl6fKyQ25RbXPN53f65NrCRfvjN1C9Dirb9FsLdb3bEo:U6qw3ssT3jl5yQ25NXPNl65kRnjN1C9n
TLSH
T14FB733B067E2A5AEF7740B757E31071EAC3E5487DEC1E9020222A133465ADCCD6DA4E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/qBittorrent\\ 5.2.2\\ (lt20)/qbittorrent.app\""
1⤵
PID:492

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/qBittorrent\\ 5.2.2\\ (lt20)/qbittorrent.app\""
1⤵
PID:492

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/qBittorrent\\ 5.2.2\\ (lt20)/qbittorrent.app"
1⤵
PID:492
- /bin/zsh
  /bin/zsh -c "open /Volumes/qBittorrent\\ 5.2.2\\ (lt20)/qbittorrent.app"
  2⤵
  PID:493

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:501

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:501

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 198
1⤵
PID:502

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:502

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.6D86A2C5-B8F7-4CCE-8040-0711F27D8701
1⤵
PID:507

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:507

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:518

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:518

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:514

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:511

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:517

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 508
1⤵
PID:521

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.30A4FF28-3B4E-47AF-9FCF-B80138AFA768
1⤵
PID:523

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.sysextd
1⤵
PID:524

/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
1⤵
PID:524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads