9e3bfe596e69234b5f1a06b0c5151ab81db633f6f1c0eb5d7d2bbbbe1e83107e

Analysis

max time kernel
149s
max time network
173s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
31/08/2026, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
santadrop.dmg
Size 24.7MB
Sample260831-h58ekaxbmf
SHA256 9e3bfe596e69234b5f1a06b0c5151ab81db633f6f1c0eb5d7d2bbbbe1e83107e
MD5 56de87bc8b31ec830bdd5599cb835ea7
SHA1 c7bb8410784525e9c05baff54547ade23f36dc11
SHA512 6089e734a9cf89e55a93efea6dcc92fc8164cb9f5b75c2fdb7da3fc9c2a673876e43ab2b0d5634bbdb4debff052b814e8d29f3030f1daab09693c587bbb8f0c1
SSDEEP 786432:9EXmuFaeBVqRNc+7jWcrmaUvh0SM+B5P/1H:9emuFaeVqRw9vhtPt9H
TLSH
T1EC47337C250FAF87F24D68BC9494963DFC7E9DAB265A6F5EC94AB42A04334241FE1103
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 1 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
"/Volumes/Santa Drop/Santa Drop.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/A2712Enabler" "/Volumes/Santa Drop/Santa Drop.app/Contents/Info.plist"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Santa\\ Drop/Santa\\ Drop.app\""
1⤵
PID:526

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Santa\\ Drop/Santa\\ Drop.app\""
1⤵
PID:526

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Santa\\ Drop/Santa\\ Drop.app"
1⤵
PID:526
- /bin/zsh
  /bin/zsh -c "open /Volumes/Santa\\ Drop/Santa\\ Drop.app"
  2⤵
  PID:527
- /usr/bin/open
  open "/Volumes/Santa Drop/Santa Drop.app"
  2⤵
  PID:527

/usr/libexec/xpcproxy
xpcproxy com.Games4YouthMinistry.SantaDrop.2332
1⤵
PID:528

/Volumes/Santa Drop/Santa Drop.app/Contents/MacOS/Santa Drop
"/Volumes/Santa Drop/Santa Drop.app/Contents/MacOS/Santa Drop"
1⤵
PID:528

/Volumes/Santa Drop/Santa Drop.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/A2712Enabler
"/Volumes/Santa Drop/Santa Drop.app/Contents/Frameworks/Adobe AIR.framework/Versions/1.0/Resources/A2712Enabler" "/Volumes/Santa Drop/Santa Drop.app/Contents/Info.plist"
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000001.Santa Drop"
1⤵
PID:532

/Volumes/Santa Drop/Santa Drop.app/Contents/MacOS/Santa Drop
"/Volumes/Santa Drop/Santa Drop.app/Contents/MacOS/Santa Drop" -psn_0_155686
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:533

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:535

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:534

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:536

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:536

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:541

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:546

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:546

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Info.plist

Path /Volumes/Santa Drop/Santa Drop.app/Contents/Info.plist
Size 1KB
SHA256 fa6ce207a8d62486cab7549c84b6f426e497d3c0f6d7a6b55221f7e900e9cc8b
MD5 90cab7063e7b3d741bbe8ac349bf20b7
SHA1 558b3ae4822223ffd05a52ac2f7791fa880dc303
SHA512 f52964af1d3a7647e657399399b28f7cccaa973dfb2bb79ae94666fef0b8dd0fa7c1dda2ed36a84737488946b283b1cd796af190b726b032e0f632462736debb
TLSH
T1022127F606F8F95909C91E6357D0510E4EC971CB4D3215FAB8CE1A459F0E90743F79A8
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads