Analysis
- max time kernel
70s - max time network
110s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
- submitted
05/08/2026, 02:55
General
- Target 2026-08-05_95426436ecec90ff971b924c69a32dd1_adload_akira_glassworm_rekoobe
- Size 2.9MB
- Sample260805-devcsswhle
- SHA256 5aac4f3e6dbf4be60ba7acddd785b39558e0cc0690d1836278de5e1097d0e545
Score
8/10
Malware Config
Signatures
- Identifies devices as anti-VM 12 IoCs
- Prompts the user for their password using a hidden input dialog 1 TTPs 1 IoCs
Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
- Queries the hardware information (I/O Kit registry). 1 TTPs 12 IoCs
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
- Queries the macOS version information. 1 TTPs 1 IoCs
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
- AppleScript 1 TTPs 1 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/2026-08-05_95426436ecec90ff971b924c69a32dd1_adload_akira_glassworm_rekoobe\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/2026-08-05_95426436ecec90ff971b924c69a32dd1_adload_akira_glassworm_rekoobe\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/2026-08-05_95426436ecec90ff971b924c69a32dd1_adload_akira_glassworm_rekoobe1⤵
-
/bin/zsh/bin/zsh -c /Users/run/2026-08-05_95426436ecec90ff971b924c69a32dd1_adload_akira_glassworm_rekoobe2⤵
-
-
/Users/run/2026-08-05_95426436ecec90ff971b924c69a32dd1_adload_akira_glassworm_rekoobe/Users/run/2026-08-05_95426436ecec90ff971b924c69a32dd1_adload_akira_glassworm_rekoobe2⤵
-
-
/usr/bin/sw_verssw_vers1⤵
-
/usr/bin/getconfgetconf LONG_BIT1⤵
-
/usr/bin/unameuname -m1⤵
-
/usr/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/sbin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/sbin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/sbin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/sbin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/bin/osascriptosascript -e "display dialog \"The current version of the app is not fully compatible with your version of MacOS. For the app to work correctly please, enter password of your system.\" with title \"Application Error\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" with hidden answer"1⤵
-
/usr/sbin/kextcache/usr/sbin/kextcache -F -system-prelinked-kernel1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.StreamingUnzipService 1971⤵
-
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService1⤵