Overview

overview

4

Static

static

1

NANI Mac 202.zip

macos-10.15-amd64

1

NANI Disto...in.pkg

macos-10.15-amd64

4

Self Insta...fo.xml

macos-10.15-amd64

1

Self Insta...S/NANI

macos-10.15-amd64

1

Self Insta...kgInfo

macos-10.15-amd64

1

Self Insta...I.rsrc

macos-10.15-amd64

4

Self Insta...te.nib

macos-10.15-amd64

4

Self Insta...es.xml

macos-10.15-amd64

1

Self Insta...fo.xml

macos-10.15-amd64

1

Self Insta...S/NANI

macos-10.15-amd64

1

Self Insta...kgInfo

macos-10.15-amd64

1

Self Insta...te.nib

macos-10.15-amd64

4

Self Insta...es.xml

macos-10.15-amd64

1

Resubmissions

24/07/2026, 01:53

260724-cbd1zaer4t4

24/07/2026, 01:52

260724-cae7mszsds4

Analysis

  • max time kernel
    62s
  • max time network
    256s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    24/07/2026, 01:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NANI Distortion Plugin.pkg
  • Size 31.4MB
  • Sample260724-cae7mszsds
  • SHA256 fc0f048ba8798e19312e527bb28ed255f78b1a8cf426f074ac2de6510ce7653b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
defense_evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
    1⤵
      PID:485
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
      1⤵
        PID:485
      • /usr/bin/sudo
        sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
        1⤵
          PID:485
          • /bin/zsh
            /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
            2⤵
              PID:486
            • /usr/sbin/installer
              installer -pkg /Users/run/setup.pkg -target /
              2⤵
                PID:486
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.installd
              1⤵
                PID:487
              • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                1⤵
                  PID:487
                • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
                  /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
                  1⤵
                    PID:488
                  • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
                    /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/739A2863-91EF-40D0-AF6A-8F28635DC7D7.activeSandbox/Root /
                    1⤵
                      PID:489
                    • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                      /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
                      1⤵
                        PID:490
                      • /usr/libexec/xpcproxy
                        xpcproxy com.apple.nsurlstoraged
                        1⤵
                          PID:496
                        • /usr/libexec/nsurlstoraged
                          /usr/libexec/nsurlstoraged --privileged
                          1⤵
                            PID:496
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.StreamingUnzipService 198
                            1⤵
                              PID:500
                            • /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                              /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                              1⤵
                                PID:500

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    com.WXAudio.pkg.au.bom
                                    • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/739A2863-91EF-40D0-AF6A-8F28635DC7D7.activeSandbox/Boms/com.WXAudio.pkg.au.bom
                                    • Size 35KB
                                    • SHA256 294e94b7c8e946819e6383390e48830654ba4c17e95200d68099968af91a43b5
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    com.WXAudio.pkg.vst3.bom
                                    • Path /Library/InstallerSandboxes/.PKInstallSandboxManager/739A2863-91EF-40D0-AF6A-8F28635DC7D7.activeSandbox/Boms/com.WXAudio.pkg.vst3.bom
                                    • Size 35KB
                                    • SHA256 1dc13846b76a70a6ad58b690fb9a31a0cf5cb2b6f4ee66a8b7a70e9993b54c9c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    installd.commit.pid
                                    • Path /private/var/run/installd.commit.pid
                                    • Size 3B
                                    • SHA256 9b19f9ab816598a0809e4afd5d60800f2dbef9cbb9b03ad2ce766b3c237b9059
                                    • MD5 SHA1 SHA512
                                    Submit Download