285dc3ef46469bfc2c6e8f3510d5b8ccf9fec4f86eb3d9c2ca67d925af3be72b

Analysis

user interaction
yes
max time kernel
130s
max time network
134s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
08/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Alcove.dmg
Size 394KB
Sample260708-e9588aaz61
SHA256 285dc3ef46469bfc2c6e8f3510d5b8ccf9fec4f86eb3d9c2ca67d925af3be72b
MD5 f7295cfc459afe6e06dc7a4fe8d0f0fb
SHA1 86121aa32069ddaf4ce8b48116841f84c05af162
SHA512 aac22f9172e3c45ff8c7ba3eda6f5273a3b9d2b692f2eea3854ff2a156de7dea349f1256fd9babed6562e4b1d5841ae73c488ef6befd373593f4882312d4df6e
SSDEEP 12288:oE2NKT6lOLA61OyIts3Xzn2frQ10Aqf6:oE2NQUAAHyIiTn2frw0A
TLSH
T17F8413B6682E6C68CF95E2F251E858964C9F33FFAA755031ED23140138D4F2A69E0D3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Alcove\""
1⤵
PID:513

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Alcove\""
1⤵
PID:513

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Alcove"
1⤵
PID:513
- /bin/zsh
  /bin/zsh -c "open /Volumes/Alcove"
  2⤵
  PID:514
- /usr/bin/open
  open /Volumes/Alcove
  2⤵
  PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:516

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:518

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:518

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:520

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.ScriptEditor2.1828
1⤵
PID:521

/System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor
"/System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor"
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:524

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:524

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:527

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 172
1⤵
PID:532

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:533

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:536

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.bsd.dirhelper
1⤵
PID:538

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:539

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:539

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:540

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:540

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:543

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:543

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:544

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:545

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metadata.keychain-db

Path /Users/run/Library/Keychains/metadata.keychain-db
Size 23KB
SHA256 a68b78907f1e88962de494dc2481ca3733e919f6a4d2330d05d1dc6ea30f3a6f
MD5 c83488a5e00138267da5d2cce4e502e1
SHA1 2437255bc34fd98dc805ac22bf32b9174a03ac3e
SHA512 56ef854cab982beaa3aca801cf7e37ddd7540e78b43f11d43b71ffdd0dc3389abb6e3331c424b8f5004698d19a7becd43334d95a046b1402c66ad922e27fcd5a
SSDEEP 192:Rz4o7VtY9RRrc2Neda+cDTfkGMv1RNhH3E:RvY9Lc24da+UTfg9RX3E
TLSH
T141B224412B559977CA940675F4F36B05BB7EE329E7470B0B2A82B0541C163D03EAEAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Alcove.scpt

Path /Volumes/Alcove/.TemporaryItems/folders.502/TemporaryItems/(A Document Being Saved By Script Editor)/Alcove.scpt
Size 146KB
SHA256 8cd2c7b3a48f947fb9fbb3f8cdd9ceaeb790bd4e5d15b20ad04604447309d315
MD5 bfd51b3092e837659e7441815dcceadb
SHA1 32ae94a8643c49f6281358e31fd31535b89f242e
SHA512 b1ee6dbb8194df234c4d836922d6f59b538a931e637ad5296cdf23fadac421ceaa4a3696d09dc31614ac9ae04176811b9eb16d2ce7014f6c01f4e5e5f2c988fe
SSDEEP 3072:79bR1RzIRXZ+4rBP1Vum4rnAoTfBwsM8AJOGHedIGfReIQtav2+rQCqpvk+3BF86:79bR1RcRXZ+4r51sm4rnr+8uav2+rVq5
TLSH
T1EAE3E02CD7B84114B9B35694A66E0801762E7F1E672FC8CC11D9C1CC47BE64EA89DF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tailspin-trace.2026-07-08_04-39-45.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-07-08_04-39-45.tailspin
Size 17.1MB
SHA256 43d2e344eb9f2452a9c6e34c79508cc6bd8d517d03550ba30d5e718bc3b3f19a
MD5 b6600f55827e596d524c5b7b03e2c1f9
SHA1 8b277fb32d900a0eb7c45b3486174813c02026ee
SHA512 924335d04538ffcf4c2e51856396719d0141e1a5ff5226df084101ae64ed3347b4297f208ea3ecbe604bb5ea89709c5231c2f67d45fef888ce6251e975b79850
SSDEEP 196608:qaAGor8kGOzDin73aTPo+L9clWygZ8IGqOeEGwmnWtHiaPMbgd:qRCEcVgZjxSd
TLSH
T19507ADB1BC4A9CF1ECE0EA7A06D34A531AF373F5ED59867D10896FC901557030E86BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tailspin-trace.2026-07-08_04-40-33.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-07-08_04-40-33.tailspin
Size 14.9MB
SHA256 9decc51758b79180d50c91dd85df0dc55e955221f1b1407bd3f0a828c3f210d2
MD5 936bf2765510834bc9cc5d669a26405c
SHA1 6a782edfe73391806d4b44ab3aaa4c2be6e00d56
SHA512 92b7404c2685a2f681792f449fa95b64f5536c7d53efc4ebbdcc143b5e0b790cff9a06c6a9fc0264de2ca33a04316ebf645963412cec5e731964fbf7e6455494
SSDEEP 196608:vdCi/r951MkFcC/utN6zusiCM64IEQrJ4kCZoCmyrCQTO:vdCClFteNTsiLWWrC
TLSH
T1BBF6AFB17C89A9B1DCC4AA7206E38A652BF332F5DC05C7BA00965F89406BB034DD5BD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UUIDToBinaryLocations

Path /var/db/spindump/UUIDToBinaryLocations
Size 84KB
SHA256 9f05b7667acdd28d0c05c18b9f27c3691bf4b21f208266bf0bf837196babc246
MD5 90fe04903b4ee77524fe4da0f1115daa
SHA1 1980dd1516e3fe75188fa44b651604536e4f26cf
SHA512 e2f393fee96f9062505374dde1d9ead8b753a87d743ab70c23de46ddc87a15e470da067154a0e291ed3d2cb555e6a20c2cd114cabfde36bd87b8763be071c7c2
SSDEEP 1536:0ixIEFZtFbxfGVObVZBgP2qkxgI8uH2Dn:0i5hxfGoqoQ
TLSH
T19683FCF48BAC5A946DD420D09AC1110B50F5F2DDBDB2F8FCAAE2516CEEDB9095231BD0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 39KB
SHA256 0abbbf79de718622983a603752337715ec5c3fca335a5f7828a0d74e33027c5f
MD5 f08a17944eabe1d8c5c60f179e7190bf
SHA1 d8710a027237e86cd0bd61b41a349dfe8c93ef9b
SHA512 c7cc6e6621f869e84d6a2573fe24fcd5b7f55f2c72e2717f3da9de8d8613704c2f05aeb9ec54d4a195057c29341c5925f95925f5a0d57d569c0e5edbd3d912fb
SSDEEP 384:maT/2i8L0SJmWSe0Mav0lQq0QsguMUGQ8LANOY41T310Qms4WiPgWsiW5xEz45cr:m+8Ltd7QqieQ8E5IOzW9WsiWrEz4Wcbu
TLSH
T1160373E08DA9189170BEC0936B0759024166A15BB8A17C3E735D9E740FC963BFBEF670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 3.9MB
SHA256 a51b7313464e55a5680cafdf9dee8ea92740ef1d9ceef69cc7927e7ecc37da3f
MD5 66ff4241235967badc81d47675424197
SHA1 918c082affed86fc417346e4ce482ffa11667e12
SHA512 2a2a8617c6247c786682e007d82ead0bd846db5b340b3041e803384644700de63e86f34d50b26f7808a046f6fad56cd1752a5c05735dc2c657f0b330686bef86
SSDEEP 12288:Wkmxue71+x+1jx/bFQFJd2x61AFULqpYGWOyrp+nKOIlEZYDPYPPtFbZftelgc11:Wc2N8hd
TLSH
T1B11640A09CED1494717EC0A32B5755014199F10BB805383EFA4EEE349F89A77E3EB978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 22KB
SHA256 bbe4e299fd4982dcf39f49789365a03e324aab59ddeb1a91eb610bc0b044d62a
MD5 67dc33dacd59b29091f10cb6bbce27e9
SHA1 67a05daa6e22001aa0bf07e8b5e33eec20f4cb1e
SHA512 b219653921746751c72dc227e9608aa6e82dae530a747d017eaece9da378be46cb7c16c3453f6928c9a6e8b583140996a74ea0b04d3d7a84deddcb7c192ba7b9
SSDEEP 384:jaZKzaAW+ly8k5svTBct9YDNM9ju6jfTaxh4zXqrnN9lhD27:jzI35sm9yOuyqh4zmN9fD27
TLSH
T113A230F0899C05A4B1A9C557A757500401A5F5ABBC86BC3CB2AEEA380F45933CBEB974
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 344KB
SHA256 bf9390898359d35ade37c88edc1fc78a228f4ac04e0c1e63356fb8e05b818160
MD5 2057a0cb2bceb7a23e95b8d09a562397
SHA1 0120fa4bb332be719760b7cb4cd475f058eda310
SHA512 a19d25d7813b44f620a2c5e43978f77b49ed9f1a86f552ee81f320c7304b63d4ab6f303698ba0cdffce65a5ace7aa9ac0b20b936376af923c1f3b9b51fea645a
SSDEEP 6144:Gee8xDmlo3PHrZr+ELJehylW4E3Pcujx4MfQtQpH+vNi9wR6/3hg4M8aGq/o3TfL:Gee8xDmlo3PHrZr+ELIMlW4E3Pcujx5j
TLSH
T19F7431A08AAC05E4B1A8D4962B33510745B6F41E7401383DF6DED3748F2AA77D3EB978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads