Overview

overview

3

Static

static

1

2026-08-16...ekoobe

macos-10.15-amd64

3

Analysis

  • max time kernel
    101s
  • max time network
    104s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    16/08/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_50583e4f2a4c01cfb058474a79b9d3f4_adload_akira_glassworm_rekoobe
  • Size 2.5MB
  • Sample260816-e89j9az1by
  • SHA256 a7d783045ff26c77295cc8bb02cacd10c594bdff8aa2d5f76d7291c0a382cc02
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • User Discovery 1 TTPs 3 IoCs

    Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

    discovery

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/2026-08-16_50583e4f2a4c01cfb058474a79b9d3f4_adload_akira_glassworm_rekoobe\""
    1⤵
      PID:484
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/2026-08-16_50583e4f2a4c01cfb058474a79b9d3f4_adload_akira_glassworm_rekoobe\""
      1⤵
        PID:484
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/2026-08-16_50583e4f2a4c01cfb058474a79b9d3f4_adload_akira_glassworm_rekoobe
        1⤵
          PID:484
          • /bin/zsh
            /bin/zsh -c /Users/run/2026-08-16_50583e4f2a4c01cfb058474a79b9d3f4_adload_akira_glassworm_rekoobe
            2⤵
              PID:486
            • /Users/run/2026-08-16_50583e4f2a4c01cfb058474a79b9d3f4_adload_akira_glassworm_rekoobe
              /Users/run/2026-08-16_50583e4f2a4c01cfb058474a79b9d3f4_adload_akira_glassworm_rekoobe
              2⤵
                PID:486
            • /tmp/syshelper_68910896
              /tmp/syshelper_68910896 run_controller rt
              1⤵
                PID:487
              • /usr/bin/sh
                sh -c "pgrep -f '/tmp/syshelper_68910896' | grep -v 487 | head -1"
                1⤵
                  PID:489
                • /bin/sh
                  sh -c "pgrep -f '/tmp/syshelper_68910896' | grep -v 487 | head -1"
                  1⤵
                    PID:490
                  • /bin/bash
                    sh -c "pgrep -f '/tmp/syshelper_68910896' | grep -v 487 | head -1"
                    1⤵
                      PID:490
                      • /usr/bin/pgrep
                        pgrep -f /tmp/syshelper_68910896
                        2⤵
                          PID:491
                        • /usr/bin/grep
                          grep -v 487
                          2⤵
                            PID:492
                          • /usr/bin/head
                            head -1
                            2⤵
                              PID:493
                          • /usr/bin/sh
                            sh -c whoami
                            1⤵
                              PID:494
                            • /bin/sh
                              sh -c whoami
                              1⤵
                                PID:495
                              • /bin/bash
                                sh -c whoami
                                1⤵
                                  PID:495
                                • /usr/bin/whoami
                                  whoami
                                  1⤵
                                    PID:495
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.ViewBridgeAuxiliary
                                    1⤵
                                      PID:506
                                    • /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                      /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                      1⤵
                                        PID:506
                                      • /usr/sbin/kextcache
                                        /usr/sbin/kextcache -F -system-prelinked-kernel
                                        1⤵
                                          PID:507

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads