7f4eba5bab6471206d7b7135601a1a3d93596a8a2fd4b9e3b9b9d4f3e476845b

Resubmissions

23/09/2026, 22:23

260923-2atgpsef454

23/09/2026, 22:04

260923-1ywrased444

Analysis

user interaction
yes
max time kernel
591s
max time network
597s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
23/09/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Jarvis - AI Assistant-2.0.0-beta.84.dmg
Size 239.1MB
Sample260923-2atgpsef45
SHA256 7f4eba5bab6471206d7b7135601a1a3d93596a8a2fd4b9e3b9b9d4f3e476845b
MD5 811784d46c4c86f192ecd7b4e8235c5c
SHA1 df82ba1173417e6fdacdc2bb347f2853951d3618
SHA512 6250e8298aa9f5b6e6cec803104e5a96649b5c8d16c839ab3e1b1fb50d13863e318f4bf8de8e5ba20db369e62cffc2a7d88d5646868c2dbbfcbcf9cdaf59579a
SSDEEP 6291456:mmLEcL23ncjuGHwn6KPzC4inTYzM1fJP1jeqqVmbNd+rn/L8m:mUEcy3ncjuGQn6Oy2MtHyvV2Nos
TLSH
T168C8337981803ACFFB67857E59BC37FAFCA3699B39EC79234340551158EB0E4442982B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Jarvis\\ -\\ AI\\ Assistant\\ 2.0.0-beta.84/Jarvis\\ -\\ AI\\ Assistant.app\""
1⤵
PID:506

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Jarvis\\ -\\ AI\\ Assistant\\ 2.0.0-beta.84/Jarvis\\ -\\ AI\\ Assistant.app\""
1⤵
PID:506

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Jarvis\\ -\\ AI\\ Assistant\\ 2.0.0-beta.84/Jarvis\\ -\\ AI\\ Assistant.app"
1⤵
PID:506
- /bin/zsh
  /bin/zsh -c "open /Volumes/Jarvis\\ -\\ AI\\ Assistant\\ 2.0.0-beta.84/Jarvis\\ -\\ AI\\ Assistant.app"
  2⤵
  PID:507
- /usr/bin/open
  open "/Volumes/Jarvis - AI Assistant 2.0.0-beta.84/Jarvis - AI Assistant.app"
  2⤵
  PID:507

/usr/libexec/xpcproxy
xpcproxy com.jarvis.ai-assistant.2332
1⤵
PID:510

/Volumes/Jarvis - AI Assistant 2.0.0-beta.84/Jarvis - AI Assistant.app/Contents/MacOS/Jarvis - AI Assistant
"/Volumes/Jarvis - AI Assistant 2.0.0-beta.84/Jarvis - AI Assistant.app/Contents/MacOS/Jarvis - AI Assistant"
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:518

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:520

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:520

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:523

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:524

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:525

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.F79E750D-9B7E-4208-81B2-ABEB96A4D4F0
1⤵
PID:526

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:535

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:533

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:530

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:534

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 528
1⤵
PID:539

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:543

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 528
1⤵
PID:546

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:546

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:545

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:549

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:549

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.5C0C7B5F-EE8D-4837-9847-63912A641A89 495
1⤵
PID:550

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:550

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:551

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:552

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tailspin-trace.2026-09-23_22-27-55.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-09-23_22-27-55.tailspin
Size 15.6MB
SHA256 cdbf534f117957f5bfe2838eefd48f4e060fbb0953d35d9670f55212c5b4d6d0
MD5 b9202c56a8db9626cef72cbf0fa1d7ca
SHA1 fd909678302e47c2149134f9035118c4d157a771
SHA512 9fb8a00281a439a805459df4dc17b136c28d5032d702e30c92b3686a9bfd70310769af946d18541fb9858e0169bf13fb6c764eb93006b6a8fed99159bebb1eaa
SSDEEP 196608:IisNhS50wof4bwOWzOM4kcGsotK/UXMi5zIvIYPy:7+hG0BAjWzteGtwWzIVPy
TLSH
T12EF66E75A84598D1CCA2AAF30983DEB30BB3F6F0BED2827D41DD66D5271B7070DA9241
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download