77afbc54df498ec2529e652f601a11ea711857990ed91f234a7e30b6b4c46c95

Analysis

max time kernel
34s
max time network
37s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
22/09/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CursorSense/CursorSense.app/Contents/MacOS/CursorSense
Size 706KB
Sample260922-w71dmax1dy
SHA256 77afbc54df498ec2529e652f601a11ea711857990ed91f234a7e30b6b4c46c95
MD5 d419873a293a99780fc531506ac358b3
SHA1 fa1d148f086adca6be5a7548b285e8a7cccd9a26
SHA512 99381568848fabc7f8722ed4ccb1346b6b425722ef363016af7a7e83699680f5736e210659272c72c6ad956cd71c1a1fd1efed9cb15cfe359b3a0e2b794faf57
SSDEEP 12288:tU7wAcpxXAIIETE1UWLwJrr1nuwyqPUcyvmByHaRR1L+:tU7RyAOTtovPaRW
TLSH
T153F42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access discovery execution

Malware Config

Signatures

Identifies hardware specifics through system_profiler 2 IoCs

ioc	Process
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"	Process not Found
system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType	Process not Found

Prompts the user for their password using a hidden input dialog 1 TTPs 2 IoCs

Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.

credential_access collection

GUI Input Capture

T1056.002

ioc	Process
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"	Process not Found
osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"	Process not Found

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"	Process not Found
osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"	Process not Found

Checks the status of system security protections 1 TTPs 1 IoCs

System utilities were executed to query the status of System Integrity Protection or FileVault encryption. This can be abused to discover local security settings.

discovery

Security Software Discovery

T1518.001

ioc	Process
/usr/bin/csrutil status	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/CursorSense/CursorSense.app/Contents/MacOS/CursorSense\""
1⤵
PID:463

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/CursorSense/CursorSense.app/Contents/MacOS/CursorSense\""
1⤵
PID:463

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/CursorSense/CursorSense.app/Contents/MacOS/CursorSense
1⤵
PID:463
- /bin/zsh
  /bin/zsh -c /Users/run/CursorSense/CursorSense.app/Contents/MacOS/CursorSense
  2⤵
  PID:464
- /Users/run/CursorSense/CursorSense.app/Contents/MacOS/CursorSense
  /Users/run/CursorSense/CursorSense.app/Contents/MacOS/CursorSense
  2⤵
  PID:464

/bin/sh
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:466

/bin/bash
sh -c "killall Terminal 2>/dev/null"
1⤵
PID:466
- /usr/bin/killall
  killall Terminal
  2⤵
  PID:467

/bin/sh
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:468

/bin/bash
sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"
1⤵
PID:468
- /usr/sbin/system_profiler
  system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
  2⤵
  PID:469

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:472

/bin/sh
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"
1⤵
PID:488

/bin/bash
sh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"
1⤵
PID:488
- /usr/bin/osascript
  osascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"
  2⤵
  PID:490