Analysis
- max time kernel
71s - max time network
114s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
13/08/2026, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
1-10-2013.dmg
Resource
macos-20250619-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
RobloxPlayer/Roblox.app/Contents/MacOS/Roblox
Resource
macos-20250619-en
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication
Resource
macos-20250619-en
1 signatures
150 seconds
General
- Target RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication
- Size 12KB
- Sample260813-g6ctlstdrd
- SHA256 58e47928c2c574bd5b73a190144c59222668ccf520e1f1d1c70d87b703885dbe
- MD5 dcc82dda5aec57d860b0fd80acf4f401
- SHA1 15717c95635253e71c8dab86ea8fc9ff4a1b7d79
- SHA512 2f93f44b77f955b3eb492a03d7db351879d6fb71935a2aad7a45e3c31b80eae191518002a562dfca22ab51abae4e84d99d00823cdb8d2bda1382efcf21a00e3b
- SSDEEP 48:ESM1beWObmL1hCFem51x/6gem0gr2EVjk4UNe13fwT+EVSJOrJF:vRCvwt1x/6tfuhd13IKS
- TLSH T1D1429596AF0D16B6D08D1378A4C603A7A171E3581DE3832ACAC9C438D7733A854F5F5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Resource Forking 1 TTPs 4 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
ioc Process sh -c "sudo /bin/zsh -c \"/Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication\"" Process not Found sudo /bin/zsh -c /Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication Process not Found /bin/zsh -c /Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication Process not Found /Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication\""1⤵PID:475
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication\""1⤵PID:475
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication1⤵PID:475
-
/bin/zsh/bin/zsh -c /Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication2⤵PID:478
-
-
/Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication/Users/run/RobloxPlayer/Roblox.app/Contents/Resources/ReLaunchApplication2⤵PID:478
-