5497ed957bd93292d2befb2880c9859a05bee72f7ddb1a78130c2dc95d069b39

Analysis

user interaction
yes
max time kernel
21s
max time network
36s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
13/08/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1-10-2013.dmg
Size 134KB
Sample260813-g6ctlstdrd
SHA256 5497ed957bd93292d2befb2880c9859a05bee72f7ddb1a78130c2dc95d069b39
MD5 d0e9a9d5f531838f676669442d585cdf
SHA1 23583665ef81974de18ad58e7205409b92533f2f
SHA512 7cca1cb5b95bfa667fd4f8274e92eb77cc98fe64396be6f3c0bb523b6444e93a94989d24ada5c02d1a4ea78bf807ff358fc0137dcdb00295494c80ba3c7900e0
SSDEEP 3072:CJpkms9N3oteshmOaEceyJFdGbBVLICI9UP6Qi6d:upkJ/YeshmCyJDGbjL3696
TLSH
T173D30278AA0D28A4ED4253F400A0629C5DEEAACB59B400BDE473494EF5C9FD37BF4617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/RobloxPlayer/Roblox.app\""
1⤵
PID:497

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/RobloxPlayer/Roblox.app\""
1⤵
PID:497

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/RobloxPlayer/Roblox.app"
1⤵
PID:497
- /bin/zsh
  /bin/zsh -c "open /Volumes/RobloxPlayer/Roblox.app"
  2⤵
  PID:498
- /usr/bin/open
  open /Volumes/RobloxPlayer/Roblox.app
  2⤵
  PID:498

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.C119B744-AF88-4945-B728-90FCC9C5509C 499
1⤵
PID:500

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:500

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.956A2817-42EC-4627-B442-D50983D6B9CF
1⤵
PID:507

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:507

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:513

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:518

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:518

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:516

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:515

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:510

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:517

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 508
1⤵
PID:520

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:522

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 195
1⤵
PID:525

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:525

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads