a1fbf25922a4f11fa9a8924920bd259de2149ac88d003e7c482104d98fb5dff9

Analysis

max time kernel
108s
max time network
112s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29/09/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
Size 2KB
Sample260929-smfa6stbjb
SHA256 a1fbf25922a4f11fa9a8924920bd259de2149ac88d003e7c482104d98fb5dff9
MD5 08ab73066f1b733a9dd7750a40b0c999
SHA1 440eeb3dca8472a9f6c24d6ad5dba8b77bbd9780
SHA512 7da16c19917d2856ed5c3e5d868ffca7062dd5433041bee1f69ec8440d2089a66c2215293cb6b85fc132a21546f37be8dd70cc30cd15bb163afce039bbe68d07
TLSH
T14D51E178F65F101C8D95313E8A3B5888BAFF9662445D169030CBD1949BED49F02EBCED
MD5 SHA1 SHA512 TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/bin/zsh -c /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js	Process not Found
/Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js	Process not Found
sh /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js	Process not Found
sh -c "sudo /bin/zsh -c \"/Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js\""	Process not Found
sudo /bin/zsh -c /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js\""
1⤵
PID:495

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js\""
1⤵
PID:495

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
1⤵
PID:495
- /bin/zsh
  /bin/zsh -c /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  2⤵
  PID:496
- /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  2⤵
  PID:496
- /bin/sh
  sh /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  2⤵
  PID:496
- /bin/bash
  sh /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  2⤵
  PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:510

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:510

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads