a02041c6b1d4cd91135cb5d568f14f196e33f4f0c9ca3f5a2cc4607979af3898

General

Target
Sapphire Patch.pkg
Size 20.1MB
Sample260722-ebmn8aac74
SHA256 a02041c6b1d4cd91135cb5d568f14f196e33f4f0c9ca3f5a2cc4607979af3898
MD5 41513fc85c0ddd84e1d6bd2deb839446
SHA1 f3f6a669e39144592a06dd236edc6adc5e40e202
SHA512 864ae6bcd380dbbd77c5c4dd9520ba44b9ac2e27b7f8050f19058b8f9bc0057982e17b1ffd84825f5cf19e87e45ee43f94c893e885b1fdc613efdaa7537b1b60
SSDEEP 393216:oZNUAdM0lApfqnJav/AbmDe81IOeVBUYYZAjE/XHHTHHl7oMq1jIqZj:kA0nJCIbceReYAAAfHznl7oMacqZj
TLSH
T15D27338EBF54EEC63B75722E5A28196CEC87E41FDC4C098510B65CB52CAB7CDA36D408
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Malware Config

Signatures

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/CE4118C8-AA2C-4F3E-83ED-29C5BCC0B686.activeSandbox/Root /	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:504

/bin/bash
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:504

/usr/bin/sudo
sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
1⤵
PID:504
- /bin/zsh
  /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
  2⤵
  PID:505
- /usr/sbin/installer
  installer -pkg /Users/run/setup.pkg -target /
  2⤵
  PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:506

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:506

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:507

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/CE4118C8-AA2C-4F3E-83ED-29C5BCC0B686.activeSandbox/Root /
1⤵
PID:508

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:510

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:511

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:530

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:532

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SapphireAEInstall-2026-LIC.bom

Path /Library/InstallerSandboxes/.PKInstallSandboxManager/CE4118C8-AA2C-4F3E-83ED-29C5BCC0B686.activeSandbox/Boms/SapphireAEInstall-2026-LIC.bom
Size 34KB
SHA256 86e08a41d6e5d97636ac10281408befe848745f2c305ab5e8a07c76bf316cba4
MD5 a2aa0d9f24f9c24d115bf7e4395e2790
SHA1 3ddcdec8eae2863979de874fd695609802eea40c
SHA512 93a0847b2d5872729307b78f10052246c596f7f639b7ea0503f59f89a9851ab57073cc08f59ddd618d4d170d5a8e6c976a0996a936171dd65257d3970e128503
SSDEEP 12:X6AzPLLCiWvIbwchjIECtmNSCKWDKWD+5hSd/9UrIzruiE6/XMia8P:Hz2igECTtmnn65hgar2/
TLSH
T108F2240767819126D0590F3786E7EB18B644F148FAC95B4F41C65C878C84B88CDABE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SapphireAEInstall-2026-cr.bom

Path /Library/InstallerSandboxes/.PKInstallSandboxManager/CE4118C8-AA2C-4F3E-83ED-29C5BCC0B686.activeSandbox/Boms/SapphireAEInstall-2026-cr.bom
Size 34KB
SHA256 40be2101039f36e0a5c004db301b3feb61a43e5bba0f57183e16b653c0f48a2c
MD5 237034892863579785f74b5b6aad236f
SHA1 eede8e852a66994b44ec40187cde64eadeeaa66d
SHA512 29f51efcfe4131579208e253afdba27c094d107316700716aff9139c3964941888cbcfe2fdf90726ebd8ba12066ffa4e711ac87fa962467d3a5da4f7de44ef5b
SSDEEP 12:FsAzPLZiCi97v2x0wchjOsCtmNSEKUKUN25iQlRkMN2kD/fUrIzrui3lHEC4KEP:FpzZJidwMUtmcjlRBNsrel
TLSH
T10FF2994397C19A26D4184F3B66FA9F287611E184EAD44B4B8044F9024C98A98CE6FE8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.keychain-db

Path /Users/run/Library/Keychains/metadata.keychain-db
Size 23KB
SHA256 495a8cff8f12dee929512876c6315f48453da4ec3a465c025c0e76419a4ec716
MD5 2c7b482c73df7eea33c8398c130827f1
SHA1 a98fea2077ffe28043fcac71c4e28e1f505d67d6
SHA512 3e8aa98f535279b65c98cb6dd8529b48e8b806ef8e1df00b30988fce09e2153dac6f697a32d7268062659b8dc18faaf52068ba37d48f82b58c968ec6d96f0310
SSDEEP 192:Rz4o7VtY9RRrc2Neda+cDTfkGMv1RNhH3/:RvY9Lc24da+UTfg9RX3/
TLSH
T126B224412B559977CA940675F4F36B05BB7EE329E7470B0B2A82B0541C163D03EAEAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installd.commit.pid

Path /private/var/run/installd.commit.pid
Size 3B
SHA256 a2075145d3cc47b2b56aeec5e9c78fe7e0055169961b6823629772c96f1f0319
MD5 ff4d5fbbafdf976cfdc032e3bde78de5
SHA1 e408d89ae85c9a0b6deaeeec2a3cf7eb0cf9c5fd
SHA512 f82fa92f0b6d2e4b9fe68cc179a5b53de478966f585bbc26e04cea6b936c69323149c9f9694b1620a31df93341efca17444b84f176f460d8011d69abb70e9ee3
MD5 SHA1 SHA512

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads