Overview

overview

7

Static

static

1

2026-08-09...ekoobe

macos-10.15-amd64

7

Analysis

  • max time kernel
    82s
  • max time network
    106s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    09/08/2026, 15:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_cb91143a6fc254731df8a7828ad007dd_adload_dosia_glassworm_helldown_poet-rat_rekoobe
  • Size 30.7MB
  • Sample260809-teqmls1eja
  • SHA256 2f50891e7068d12015942d3be39559c10b31affc937258f7b55113e5055e2007
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • System Checks 1 TTPs 1 IoCs

    Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

    defense_evasion
  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2026-08-09_cb91143a6fc254731df8a7828ad007dd_adload_dosia_glassworm_helldown_poet-rat_rekoobe\""
    1⤵
      PID:488
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2026-08-09_cb91143a6fc254731df8a7828ad007dd_adload_dosia_glassworm_helldown_poet-rat_rekoobe\""
      1⤵
        PID:488
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2026-08-09_cb91143a6fc254731df8a7828ad007dd_adload_dosia_glassworm_helldown_poet-rat_rekoobe
        1⤵
          PID:488
          • /bin/zsh
            /bin/zsh -c /Users/run/2026-08-09_cb91143a6fc254731df8a7828ad007dd_adload_dosia_glassworm_helldown_poet-rat_rekoobe
            2⤵
              PID:491
            • /Users/run/2026-08-09_cb91143a6fc254731df8a7828ad007dd_adload_dosia_glassworm_helldown_poet-rat_rekoobe
              /Users/run/2026-08-09_cb91143a6fc254731df8a7828ad007dd_adload_dosia_glassworm_helldown_poet-rat_rekoobe
              2⤵
                PID:491
                • /usr/sbin/system_profiler
                  system_profiler SPHardwareDataType
                  3⤵
                    PID:492
                  • /usr/sbin/system_profiler
                    system_profiler SPDisplaysDataType
                    3⤵
                      PID:496
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.sysmond
                  1⤵
                    PID:509
                  • /usr/libexec/sysmond
                    /usr/libexec/sysmond
                    1⤵
                      PID:509
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.audio.systemsoundserverd
                      1⤵
                        PID:510
                      • /usr/sbin/systemsoundserverd
                        /usr/sbin/systemsoundserverd
                        1⤵
                          PID:510
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.audio.AudioComponentRegistrar
                          1⤵
                            PID:513
                          • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                            /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                            1⤵
                              PID:513
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.nsurlstoraged
                              1⤵
                                PID:520
                              • /usr/libexec/nsurlstoraged
                                /usr/libexec/nsurlstoraged --privileged
                                1⤵
                                  PID:520
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.StreamingUnzipService 186
                                  1⤵
                                    PID:521
                                  • /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                    /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                    1⤵
                                      PID:521
                                    • /bin/launchctl
                                      /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                                      1⤵
                                        PID:525
                                      • /bin/launchctl
                                        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                                        1⤵
                                          PID:526
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                          1⤵
                                            PID:527
                                          • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                            /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                            1⤵
                                              PID:527

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads