Analysis
- max time kernel
108s - max time network
103s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
- submitted
06/08/2026, 01:20
General
- Target 2026-08-06_a098f2d2697145ac27e748d12a2a240b_akira_glassworm_rekoobe
- Size 4.8MB
- Sample260806-bqb99awsbx
- SHA256 35f4562d35439e2485b3df3aaad1529c68f28a485da30e4042919dfb95fe69bf
Score
8/10
Malware Config
Signatures
- Identifies devices as anti-VM 12 IoCs
- Prompts the user for their password using a hidden input dialog 1 TTPs 1 IoCs
Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
- Queries the hardware information (I/O Kit registry). 1 TTPs 12 IoCs
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
- Queries the macOS version information. 1 TTPs 2 IoCs
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
- AppleScript 1 TTPs 1 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/2026-08-06_a098f2d2697145ac27e748d12a2a240b_akira_glassworm_rekoobe\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/2026-08-06_a098f2d2697145ac27e748d12a2a240b_akira_glassworm_rekoobe\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/2026-08-06_a098f2d2697145ac27e748d12a2a240b_akira_glassworm_rekoobe1⤵
-
/bin/zsh/bin/zsh -c /Users/run/2026-08-06_a098f2d2697145ac27e748d12a2a240b_akira_glassworm_rekoobe2⤵
-
-
/Users/run/2026-08-06_a098f2d2697145ac27e748d12a2a240b_akira_glassworm_rekoobe/Users/run/2026-08-06_a098f2d2697145ac27e748d12a2a240b_akira_glassworm_rekoobe2⤵
-
-
/usr/bin/sw_verssw_vers1⤵
-
/usr/bin/getconfgetconf LONG_BIT1⤵
-
/usr/bin/unameuname -m1⤵
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵
-
/usr/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/sbin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/sbin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/sbin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/bin/sw_verssw_vers1⤵
-
/usr/bin/getconfgetconf LONG_BIT1⤵
-
/usr/bin/unameuname -m1⤵
-
/usr/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/bin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/sbin/ioregioreg -rd1 -c IOPlatformExpertDevice1⤵
-
/usr/bin/osascriptosascript -e "display dialog \"The current version of the app is not fully compatible with your version of MacOS. For the app to work correctly please, enter password of your system.\" with title \"Application Error\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" with hidden answer"1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵