Analysis
- user interaction
yes - max time kernel
98s - max time network
104s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
07/09/2026, 17:52
Static task
static1
Behavioral task
behavioral1
Sample
SKlauncher-3.2.18.dmg
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
SKlauncher/SKlauncher.app/Contents/Java/SKlauncher.jar
Resource
macos-20250619-en
Behavioral task
behavioral3
Sample
SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
Resource
macos-20250619-en
General
- Target SKlauncher-3.2.18.dmg
- Size 1.4MB
- Sample260907-wf6fkasdja
- SHA256 65d0c8a5ba00ae164aa68f7ad6c4aa305c46e1b0236fb3e2790bc8bd970f200f
- MD5 f0c830ad8707f58093b8cea694f1d9a6
- SHA1 f43922ad06985911e3d8628e6e9efa0bff62f411
- SHA512 6c9fa5f30016ec26b61fdacf10814c3af49871d8a9b05b3aa9b59dee256c1e55be97d6a24aa8affa94010ce2f133040ca3c0bba8af2420e11257c6a7f38ed366
- SSDEEP 24576:3prpWsSHTkRGrpqk4P8Tqut93SqhrV60n7hayrpaoIXP5jS3YonrZc8AujlWIZ6Z:ZpmkR6ck1TdVL7My9aPZS35ZX3lW3Z
- TLSH T13F65337E998EBA48ED50FA30DCB954150EBC36E7E472C7B7BC3F092A5350641216E12B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- File and Directory Discovery. 1 TTPs 18 IoCs
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
ioc Process basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found dirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\"" Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub Process not Found - Resource Forking 1 TTPs 5 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
ioc Process /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool Process not Found /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool Process not Found /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck Process not Found /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref Process not Found /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool Process not Found
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"open /Volumes/SKlauncher/SKlauncher.app\""1⤵PID:526
-
/bin/bashsh -c "sudo /bin/zsh -c \"open /Volumes/SKlauncher/SKlauncher.app\""1⤵PID:526
-
/usr/bin/sudosudo /bin/zsh -c "open /Volumes/SKlauncher/SKlauncher.app"1⤵PID:526
-
/bin/zsh/bin/zsh -c "open /Volumes/SKlauncher/SKlauncher.app"2⤵PID:527
-
-
/usr/bin/openopen /Volumes/SKlauncher/SKlauncher.app2⤵PID:527
-
-
/usr/libexec/xpcproxyxpcproxy pl.skmedix.bootstrap.Main.23321⤵PID:528
-
/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub1⤵PID:528
-
/usr/bin/bashbash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub1⤵PID:528
-
/bin/bashbash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub1⤵PID:528
-
/usr/bin/dirnamedirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:529
-
-
/usr/bin/basenamebasename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\""2⤵PID:530
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:531
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][universalJavaApplicationStub\"] [StubDir] /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS"2⤵PID:532
-
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :Java" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist2⤵PID:539
-
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JavaX" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist2⤵PID:540
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:541
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [PlistStyle] Oracle"2⤵PID:542
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:582
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaRequirement] JVM minimum version: 21+"2⤵PID:583
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:584
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaRequirement] JVM maximum version: "2⤵PID:585
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:588
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [LanguageSearch] Checking preferred languages in macOS System Preferences..."2⤵PID:589
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:596
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [LanguageSearch] ... found [en-NL nl-NL de-NL]"2⤵PID:597
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:598
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [LanguageSearch] ... selected 'en' (from 'en-NL') as the default language for the launcher stub"2⤵PID:599
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:600
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [Language] en"2⤵PID:601
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:626
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] Checking for \$JAVA_HOME ..."2⤵PID:627
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:628
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] ... using JAVA_HOME is disabled"2⤵PID:629
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:630
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] Searching for JavaVirtualMachines on the system ..."2⤵PID:631
-
-
/usr/libexec/java_home/usr/libexec/java_home --xml2⤵PID:632
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:638
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] ... found JVM: 1.8.0_301:/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java"2⤵PID:639
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:640
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] Filtering the result list for JVMs matching the min/max version requirement ..."2⤵PID:641
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:651
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaCommand] ''"2⤵PID:652
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:658
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaVersion] "2⤵PID:659
-
-
/usr/bin/basenamebasename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub2⤵PID:665
-
-
/usr/bin/syslogsyslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [EXIT 3] No suitable Java version found on your system! This program requires Java 21 or later."2⤵PID:666
-
-
/usr/bin/osascriptosascript2⤵PID:667
-
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :CFBundleName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:536
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :CFBundleIconFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:538
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMMainClassName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:544
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMSplashFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:546
-
/usr/bin/grepgrep " "1⤵PID:549
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:551
-
/usr/bin/sedsed "s/^ *//g"1⤵PID:550
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMClassPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:553
-
/usr/bin/grepgrep -o " \\-.*"1⤵PID:556
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMDefaultOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:557
-
/usr/bin/trtr -d "\\n"1⤵PID:558
-
/usr/bin/xargsxargs1⤵PID:559
-
/usr/bin/trtr -d "\\n"1⤵PID:565
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMArguments" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:566
-
/usr/bin/sedsed -E "s/Array \\{ *(.*) *\\}/\\1/g"1⤵PID:567
-
/usr/bin/sedsed "s/ */ /g"1⤵PID:568
-
/usr/bin/xargsxargs -n11⤵PID:562
-
/usr/bin/xargsxargs1⤵PID:571
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMVersion" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:572
-
/bin/echo/bin/echo 21+1⤵PID:573
-
/usr/bin/xargsxargs1⤵PID:576
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMUseJavaHome" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:577
-
/usr/bin/xargsxargs1⤵PID:580
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c "print :JVMEmbeddedJavaPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist1⤵PID:581
-
/usr/bin/grepgrep "\\s\""1⤵PID:592
-
/usr/bin/defaultsdefaults read -g AppleLanguages1⤵PID:591
-
/usr/bin/trtr -d ","1⤵PID:593
-
/usr/bin/xargsxargs1⤵PID:594
-
/bin/echo/bin/echo en-NL nl-NL de-NL1⤵PID:595
-
/Library/Java/Home/bin/java/Library/Java/Home/bin/java -version1⤵PID:604
-
/usr/bin/sedsed -E "s/\"//g;s/-ea//g"1⤵PID:606
-
/usr/bin/awkawk "/version/{print \$3}"1⤵PID:605
-
/usr/bin/awkawk "/version/{print \$3}"1⤵PID:610
-
/usr/bin/sedsed -E "s/\"//g;s/-ea//g"1⤵PID:611
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -version1⤵PID:609
-
/usr/bin/sedsed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"1⤵PID:615
-
/usr/bin/sedsed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"1⤵PID:622
-
/usr/libexec/PlistBuddy/usr/libexec/PlistBuddy -c Print /dev/stdin1⤵PID:634
-
/usr/bin/grepgrep Dict1⤵PID:635
-
/usr/bin/trtr -d " "1⤵PID:637
-
/usr/bin/wcwc -l1⤵PID:636
-
/usr/bin/sedsed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"1⤵PID:645
-
/usr/bin/sortsort -nr1⤵PID:650
-
/usr/bin/sedsed -E "s/\"//g;s/-ea//g"1⤵PID:657
-
/usr/bin/awkawk "/version/{print \$3}"1⤵PID:656
-
/usr/bin/sedsed -E "s/^1\\.([0-9+*]+)\$/\\1/g"1⤵PID:662
-
/usr/bin/sedsed "s/+/ or later/;s/*/(latest update)/"1⤵PID:663
-
/usr/libexec/xpcproxyxpcproxy com.apple.systempreferences.21401⤵PID:676
-
/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"1⤵PID:676
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountProfileRemoteViewService 6761⤵PID:677
-
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService1⤵PID:677
-
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool1⤵PID:678
-
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool1⤵PID:679
-
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck1⤵PID:680
-
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref1⤵PID:681
-
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool1⤵PID:682
-
/usr/libexec/xpcproxyxpcproxy com.apple.nfcd1⤵PID:684
-
/usr/libexec/nfcd/usr/libexec/nfcd1⤵PID:684
-
/usr/libexec/xpcproxyxpcproxy com.apple.studentd1⤵PID:685
-
/usr/libexec/studentd/usr/libexec/studentd1⤵PID:685
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵PID:686
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵PID:686
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /var/tmp//sh-thd-1788817829
- Size 182B
- SHA256 b6b1b914ea63ef79a16f0f0e361371a0df82b27c554c7bbc2384161a0170ddb1
- MD5 b9b44e0346dfd1cf6cb1079e05af6180
- SHA1 62eab631a6d419c7f649bcd7f14f7bc411029711
- SHA512 dfdf73e3622bf203a83bd2aceda23c50e247e5c2a14e1da41f28052d6d44ffe9a5e009f7eca1764ac0e24750bf061ae866271cd608a7082b4d5527f21b08714b
- TLSH T1A7C022454640E86900C08B8B1729E1445310F39689B0059C00D01C824A07195930026E
- MD5 SHA1 SHA512 TLSH
- Path /var/tmp//sh-thd-1788818485
- Size 555B
- SHA256 8147bf5e15930597be48929686291e59d57687333e87eaa9c199bede9323c778
- MD5 1d228cd384645fed5912c334df6197a8
- SHA1 343fe4876d22511c3191604c18f9db485893bbf0
- SHA512 279336c73afcb4680c224e34c3a9844bc0763d93df4315b7c45e03f3e11bdd19ad4d3f616c687fdc61ba671538da4f8f8026dc3fb8467cf77f1bc006abddd338
- TLSH T1E8F081579784D23E6F0341D0650B05A9F71DD48423D1E07B95C680DFE4C523F17A5866
- MD5 SHA1 SHA512 TLSH
- Path /var/tmp//sh-thd-1788833835
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512