Overview
overview
7Static
static
1devmarker.dmg
macos-10.15-amd64
1InstallExt...marker
macos-10.15-amd64
1InstallExt...marker
macos-10.15-amd64
4InstallExt...versal
macos-10.15-amd64
7InstallExt/install.sh
ubuntu-18.04-amd64
7InstallExt/install.sh
debian-9-armhf
7InstallExt/install.sh
debian-9-mips
7InstallExt/install.sh
debian-9-mipsel
7Analysis
- max time kernel
66s - max time network
137s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
25/08/2026, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
devmarker.dmg
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
InstallExt/Install Extension.app/Contents/MacOS/devmarker
Resource
macos-20250619-en
Behavioral task
behavioral3
Sample
InstallExt/Install Extension.app/Contents/Resources/devmarker
Resource
macos-20250619-en
Behavioral task
behavioral4
Sample
InstallExt/devmarker_macos_universal
Resource
macos-20250619-en
Behavioral task
behavioral5
Sample
InstallExt/install.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
InstallExt/install.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral7
Sample
InstallExt/install.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral8
Sample
InstallExt/install.sh
Resource
debian9-mipsel-20260513-en
General
- Target devmarker.dmg
- Size 7.8MB
- Sample260825-gyzy6seq2v
- SHA256 664ef47db9945c94db09faecc092036984dcaeec67db5f3b6e61297679cc2036
- MD5 70e2cf00f3880940c9a76415ddeb6630
- SHA1 3a2d42a9f576ab5e2b028af9756bc5b68c6e636b
- SHA512 38671bd28361a96489505846442f977ba7e8115f1c24d0855fe2605686ed0603d75fe1cd1418a20a13581632dfaf978c988133801038f5237dff54e11317dc22
- SSDEEP 196608:YfUzkaocjtxUOOQSOh+K8VUns4Lkwsjum4/2VxI1yVwikRAT7/v5:4Ika3/UOrN+6sJwZOV21yuPRw7v5
- TLSH T11D86337A2EBD5ECCDF909ABB41525602CFCDD253E81B17D6AA10148D2FDC4CD7E2812A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"open /Volumes/InstallExt/Install\\ Extension.app\""1⤵PID:494
-
/bin/bashsh -c "sudo /bin/zsh -c \"open /Volumes/InstallExt/Install\\ Extension.app\""1⤵PID:494
-
/usr/bin/sudosudo /bin/zsh -c "open /Volumes/InstallExt/Install\\ Extension.app"1⤵PID:494
-
/bin/zsh/bin/zsh -c "open /Volumes/InstallExt/Install\\ Extension.app"2⤵PID:495
-
-
/usr/bin/openopen "/Volumes/InstallExt/Install Extension.app"2⤵PID:495
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵PID:502
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵PID:502
-
/usr/libexec/xpcproxyxpcproxy com.apple.StreamingUnzipService 1951⤵PID:503
-
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService1⤵PID:503