6e363d1d70a9132af88447f63684eaf2b05fc37b5be2d46187945c899f53f358

Analysis

max time kernel
148s
max time network
161s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25/09/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mzrustclientcpmac-x64.dmg
Size 28.9MB
Sample260925-xt1mxavblc
SHA256 6e363d1d70a9132af88447f63684eaf2b05fc37b5be2d46187945c899f53f358
MD5 25161a4f72de3ed63aa332e26b1062b3
SHA1 e2095e4ff83f8330d5b4285bf9ee560e20749807
SHA512 8ce451bb4d27fd7bd72ec5e1291abd489bb63b53b57b050893950a503696663289cbbbda6393aa50ba74e941c536f641ff4ce5e6ed3867098c5bb0033c5ed717
SSDEEP 786432:ZGox0FDZyhPlci/vPOOiNsy0nChF76s+5M6jTps:kFDshNcFdsTC3761WCT
TLSH
T12A673337699F1D19F8D955B0425A5372CC8ACC17B3C7FEEA88613D251A37068DB30A8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Identifies devices as anti-VM 3 IoCs

ioc	Process
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found

Queries the hardware information (I/O Kit registry). 1 TTPs 3 IoCs

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

discovery

System Information Discovery

T1082

ioc	Process
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/MyApp/MZRustClientCPMac.app\""
1⤵
PID:513

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/MyApp/MZRustClientCPMac.app\""
1⤵
PID:513

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/MyApp/MZRustClientCPMac.app"
1⤵
PID:513
- /bin/zsh
  /bin/zsh -c "open /Volumes/MyApp/MZRustClientCPMac.app"
  2⤵
  PID:514
- /usr/bin/open
  open /Volumes/MyApp/MZRustClientCPMac.app
  2⤵
  PID:514

/usr/libexec/xpcproxy
xpcproxy de.mzolutions.macrustclient.2332
1⤵
PID:515

/Volumes/MyApp/MZRustClientCPMac.app/Contents/MacOS/MZRustClientCPMac
/Volumes/MyApp/MZRustClientCPMac.app/Contents/MacOS/MZRustClientCPMac
1⤵
PID:515

/usr/bin/ioreg
ioreg -rd1 -c IOPlatformExpertDevice
1⤵
PID:529

/bin/ioreg
ioreg -rd1 -c IOPlatformExpertDevice
1⤵
PID:530

/usr/sbin/ioreg
ioreg -rd1 -c IOPlatformExpertDevice
1⤵
PID:531

/Volumes/MyApp/MZRustClientCPMac.app/Contents/MacOS/MZRustClientCPMac
/Volumes/MyApp/MZRustClientCPMac.app/Contents/MacOS/MZRustClientCPMac --check-hwcodec-config
1⤵
PID:532

/usr/bin/ls
ls -l /dev/console
1⤵
PID:534

/bin/ls
ls -l /dev/console
1⤵
PID:535

/usr/bin/ls
ls -l /dev/console
1⤵
PID:536

/bin/ls
ls -l /dev/console
1⤵
PID:537

/usr/bin/ls
ls -l /dev/console
1⤵
PID:538

/bin/ls
ls -l /dev/console
1⤵
PID:539

/usr/bin/ls
ls -l /dev/console
1⤵
PID:542

/bin/ls
ls -l /dev/console
1⤵
PID:543

/usr/bin/ls
ls -l /dev/console
1⤵
PID:544

/bin/ls
ls -l /dev/console
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videoencoder 532
1⤵
PID:546

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTEncoderXPCService.xpc/Contents/MacOS/VTEncoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTEncoderXPCService.xpc/Contents/MacOS/VTEncoderXPCService
1⤵
PID:546

/usr/bin/ls
ls -l /dev/console
1⤵
PID:550

/bin/ls
ls -l /dev/console
1⤵
PID:551

/usr/bin/ls
ls -l /dev/console
1⤵
PID:552

/bin/ls
ls -l /dev/console
1⤵
PID:553

/usr/bin/ls
ls -l /dev/console
1⤵
PID:556

/bin/ls
ls -l /dev/console
1⤵
PID:557

/usr/bin/ls
ls -l /dev/console
1⤵
PID:558

/bin/ls
ls -l /dev/console
1⤵
PID:559

/usr/bin/ls
ls -l /dev/console
1⤵
PID:560

/bin/ls
ls -l /dev/console
1⤵
PID:561

/usr/bin/ls
ls -l /dev/console
1⤵
PID:562

/bin/ls
ls -l /dev/console
1⤵
PID:563

/usr/bin/ls
ls -l /dev/console
1⤵
PID:564

/bin/ls
ls -l /dev/console
1⤵
PID:565

/usr/bin/ls
ls -l /dev/console
1⤵
PID:566

/bin/ls
ls -l /dev/console
1⤵
PID:567

/usr/bin/ls
ls -l /dev/console
1⤵
PID:568

/bin/ls
ls -l /dev/console
1⤵
PID:569

/usr/bin/ls
ls -l /dev/console
1⤵
PID:570

/bin/ls
ls -l /dev/console
1⤵
PID:571

/usr/bin/ls
ls -l /dev/console
1⤵
PID:572

/bin/ls
ls -l /dev/console
1⤵
PID:573

/usr/bin/ls
ls -l /dev/console
1⤵
PID:575

/bin/ls
ls -l /dev/console
1⤵
PID:576

/usr/bin/ls
ls -l /dev/console
1⤵
PID:577

/bin/ls
ls -l /dev/console
1⤵
PID:578

/usr/bin/ls
ls -l /dev/console
1⤵
PID:579

/bin/ls
ls -l /dev/console
1⤵
PID:580

/usr/bin/ls
ls -l /dev/console
1⤵
PID:581

/bin/ls
ls -l /dev/console
1⤵
PID:582

/usr/bin/ls
ls -l /dev/console
1⤵
PID:583

/bin/ls
ls -l /dev/console
1⤵
PID:584

/usr/bin/ls
ls -l /dev/console
1⤵
PID:585

/bin/ls
ls -l /dev/console
1⤵
PID:586

/usr/bin/ls
ls -l /dev/console
1⤵
PID:590

/bin/ls
ls -l /dev/console
1⤵
PID:591

/usr/bin/ls
ls -l /dev/console
1⤵
PID:592

/bin/ls
ls -l /dev/console
1⤵
PID:593

/usr/bin/ls
ls -l /dev/console
1⤵
PID:594

/bin/ls
ls -l /dev/console
1⤵
PID:595

/usr/bin/ls
ls -l /dev/console
1⤵
PID:596

/bin/ls
ls -l /dev/console
1⤵
PID:597

/usr/bin/ls
ls -l /dev/console
1⤵
PID:598

/bin/ls
ls -l /dev/console
1⤵
PID:599

/usr/bin/ls
ls -l /dev/console
1⤵
PID:600

/bin/ls
ls -l /dev/console
1⤵
PID:601

/usr/bin/ls
ls -l /dev/console
1⤵
PID:602

/bin/ls
ls -l /dev/console
1⤵
PID:603

/usr/bin/ls
ls -l /dev/console
1⤵
PID:604

/bin/ls
ls -l /dev/console
1⤵
PID:605

/usr/bin/ls
ls -l /dev/console
1⤵
PID:606

/bin/ls
ls -l /dev/console
1⤵
PID:607

/usr/bin/ls
ls -l /dev/console
1⤵
PID:608

/bin/ls
ls -l /dev/console
1⤵
PID:609

/usr/bin/ls
ls -l /dev/console
1⤵
PID:610

/bin/ls
ls -l /dev/console
1⤵
PID:611

/usr/bin/ls
ls -l /dev/console
1⤵
PID:612

/bin/ls
ls -l /dev/console
1⤵
PID:613

/usr/bin/ls
ls -l /dev/console
1⤵
PID:614

/bin/ls
ls -l /dev/console
1⤵
PID:615

/usr/bin/ls
ls -l /dev/console
1⤵
PID:616

/bin/ls
ls -l /dev/console
1⤵
PID:617

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MZRustClientCPMac.toml

Path /Users/run/Library/Preferences/com.carriez.MZRustClientCPMac/MZRustClientCPMac.toml
Size 177B
SHA256 71313fb51956e5225b6efde0b1cb3e70f07e091a16f738713fbc11c2144e17a2
MD5 7fd00a2c612f3351a17346eda1a63cb4
SHA1 9f65316a7dd802f10e8ac0885fd910ea1daefc49
SHA512 f07496fdae850d2f6f45e044a76c221a8fff8d5675e6baa70d043eeb0c4239fceef9cf46b625e07df1273a0b695fb56bfd8a48c26c8776081cbb3819e00ac6fc
TLSH
T137C08097483F6C0511009262C327E7404B456173565D35115D1E834C2FD6550356454F
MD5 SHA1 SHA512 TLSH

Submit Download

MZRustClientCPMac2.toml

Path /Users/run/Library/Preferences/com.carriez.MZRustClientCPMac/MZRustClientCPMac2.toml
Size 125B
SHA256 9b19f971da2d00f92ea8cdcc36bad1ad42c7e665d0fe82ab5ab296ff1d9a66dd
MD5 2e471b28b73cc4fc0dab42d287d0a476
SHA1 bbe6a87697d15362c2e49de1706b01ca3c72db24
SHA512 b48fc22a18eaccefc730db8baae37fcac498ea791cb5800400b58855b68225a15da1acc11f2e3b6def79438514250dddbd3346f5bda4c37cd77c4be7479f711c
TLSH
T185B02280CAB33A8020CA00C00C3B2038CC2C83322A8A0AE03383C200A0CCA0ACB08E2B
MD5 SHA1 SHA512 TLSH

Submit Download

MZRustClientCPMac2.toml

Path /Users/run/Library/Preferences/com.carriez.MZRustClientCPMac/MZRustClientCPMac2.toml
Size 125B
SHA256 f5ebda4a25c6e1afff0de5dbdbf87f5bb30dd88755893c01597949b8af3c24e1
MD5 e4e5ca58528f2b63fc3439a6e6ee2a15
SHA1 c6364d06ed67336264abd194d38f3511f28fd7ce
SHA512 e2ee4626e87879ae523119c8bc16a6b8a2169379dbbaa42668e01a3c2eb10cc6d4c6cdfbe9b1a2fbdd031e52c712afb325d7b1827132a2f338c4d59db3110f45
TLSH
T1CCB02B40C673378010C500C00C3B6034CC2C8331194A05D02383C20060CC50ACB08D16
MD5 SHA1 SHA512 TLSH

Submit Download

MZRustClientCPMac2.toml

Path /Users/run/Library/Preferences/com.carriez.MZRustClientCPMac/MZRustClientCPMac2.toml
Size 140B
SHA256 d880b9bc1bc3fd87ee63c3cd0fca1065f621efd5930538b0e4cabfb879a560b1
MD5 4a67be6ee2a346dc9b91a7da2e0b8054
SHA1 d2e3338ae1985c0f747cfe27e8baf0af0244fe6f
SHA512 611bf596213a84847708294114bd764384bbe2dc5efd94098d5b2e106bc172b5cccf7d7d1efb08566b2fe0da2d327c70d4a800cb9588bcd868c2931d2680292d
TLSH
T1A1C02B40C673378420C604C40D3B7039CC2CC3311A4E09E023C3C24964CC50BCB4CD16
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads