44c28932686a60a4491d364ee95b9f720eed1bc46d7be03b5bfa3da4bfc7c277

Analysis

user interaction
yes
max time kernel
104s
max time network
104s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29/09/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
Size 14KB
Sample260929-smfa6stbjb
SHA256 44c28932686a60a4491d364ee95b9f720eed1bc46d7be03b5bfa3da4bfc7c277
MD5 7d805188f36ed75082b0928ab11f50b5
SHA1 2435f25bde7679372791e0264e37887473d94e0b
SHA512 363d6d3c6ba42cdf285dc5c1a6799ab3108b2ccafc90daca1ce3874a15af02230a6e7a549e0993c3e98ac1d186a5caba313b145f05b8645340cee33d6024807c
SSDEEP 192:Eg+wPlEl4ZXFS0S4WE+wA/d+whvWlZlTZP7kpCS7CS4CZgtCtWAsUog7F/7pl2db:Eg+wzZNTRAJwbQzoOWAsv
TLSH
T15262E1A86A0E172C4993337FFEAB87145C3F90631C242215B4C6DDA482EDE9F46579CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
sh -c "sudo /bin/zsh -c \"/Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js\""	Process not Found
sudo /bin/zsh -c /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js	Process not Found
/bin/zsh -c /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js	Process not Found
/Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js	Process not Found
sh /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js\""
1⤵
PID:486

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js\""
1⤵
PID:486

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
1⤵
PID:486
- /bin/zsh
  /bin/zsh -c /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  2⤵
  PID:487
- /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  2⤵
  PID:487
- /bin/sh
  sh /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  2⤵
  PID:487
- /bin/bash
  sh /Users/run/Octane-Mac/RobloxPlayer.app/Contents/Resources/ExtraContent/LuaPackages/Packages/_Index/roact-naviga.js
  2⤵
  PID:487

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads