7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

Analysis

user interaction
yes
max time kernel
782s
max time network
489s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
30/09/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamSetup.exe
Size 2.3MB
Sample260930-rbwcksgh69
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
TLSH
T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 11 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"	Process not Found
/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/SteamSetup.exe\""
1⤵
PID:470

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/SteamSetup.exe\""
1⤵
PID:470

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/SteamSetup.exe
1⤵
PID:470
- /bin/zsh
  /bin/zsh -c /Users/run/SteamSetup.exe
  2⤵
  PID:471
- /Users/run/SteamSetup.exe
  /Users/run/SteamSetup.exe
  2⤵
  PID:471

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:494

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:494

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:495

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:495

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:496

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:498

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:498

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:499

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.9EE69FFA-0473-4C81-83B0-951C4924EF5C 498
1⤵
PID:500

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:500

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:505

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.41AFCA92-5763-4627-AB97-9C83ED68AAD0 498
1⤵
PID:508

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 498
1⤵
PID:510

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:513

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.415506A8-82FC-47CE-8BE6-0B15095559B7 498
1⤵
PID:516

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:518

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.AppStore.1900
1⤵
PID:521

/System/Applications/App Store.app/Contents/MacOS/App Store
"/System/Applications/App Store.app/Contents/MacOS/App Store"
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:522

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 521
1⤵
PID:526

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:527

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:528

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.8A17AD95-342E-40FC-BCD3-CF4B47A1F41F 521
1⤵
PID:530

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:532

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:533

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:534

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:535

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:536

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:537

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:538

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 538
1⤵
PID:539

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:539

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:540

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:541

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:542

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:543

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:546

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:545

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.preferences.softwareupdate.remoteservice 538
1⤵
PID:547

/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.softwareupdated
1⤵
PID:548

/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.suhelperd
1⤵
PID:549

/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.SoftwareUpdateNotificationManager
1⤵
PID:552

/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager
/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:553

/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues
/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues -z
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:556

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:559

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.mobileassetd
1⤵
PID:562

/usr/libexec/mobileassetd
/usr/libexec/mobileassetd
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:564

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:565

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.tccd
1⤵
PID:566

/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:567

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:568

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenTimeAgent
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.coreduetd
1⤵
PID:570

/usr/libexec/coreduetd
/usr/libexec/coreduetd
1⤵
PID:570

/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:571

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:573

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:574

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.CodeSigningHelper
1⤵
PID:578

/System/Library/Frameworks/Security.framework/Versions/A/XPCServices/com.apple.CodeSigningHelper.xpc/Contents/MacOS/com.apple.CodeSigningHelper
/System/Library/Frameworks/Security.framework/Versions/A/XPCServices/com.apple.CodeSigningHelper.xpc/Contents/MacOS/com.apple.CodeSigningHelper
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesagent
1⤵
PID:579

/System/Library/CoreServices/iconservicesagent
/System/Library/CoreServices/iconservicesagent
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesd
1⤵
PID:580

/System/Library/CoreServices/iconservicesd
/System/Library/CoreServices/iconservicesd
1⤵
PID:580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstalledPrinters.plist

Path /Library/Printers/InstalledPrinters.plist
Size 493B
SHA256 e0793c0ca711a365c6f180c4c4c7cec54fcf794bc1ff9d981f1015a0d6ed170c
MD5 95ab91f7cef5b4f30adffaa5e94a053e
SHA1 88c20677d32ffdf55af5bca3b3c992725d563eaa
SHA512 5111dbd59b827050ce3e1e4a141f3fa0b0be687dc9d14fd1a5627782ef588e4c1160c7527de932a7062a17d0f165d289bdc710636a0c6f5ef7e3cefac1631888
TLSH
T147F0E2D80908797E4DCA12020AF9D85852BE82CD8C7104FBF6D34C89BE494A2E230D58
MD5 SHA1 SHA512 TLSH

Submit Download

9566F919BD3BBC2C387300B8C988041E

Path /Users/run/Library/Safari/Favicon Cache/favicons/9566F919BD3BBC2C387300B8C988041E
Size 5KB
SHA256 3c72b5289d0ad6e8074e6b55427d2053c815c9d73dbf38e32e51adb2c8e3782b
MD5 23c8cd2f291839cb4c9ff38d534ea935
SHA1 c75cafad3f13671bab06c14090bca30d84a5308a
SHA512 ddc2e3a80b257c1445c62bdc398dbc1503fa5dd1ef209759be908c1d650a305b2dd2166390abb17d60efb5120e3dd3cdf23e8d906a59cfc54f8376b7f533e5ab
SSDEEP 48:GXxe7qlQ5PhYXhFAN6Ci4NzTGURKnohCRumHNn+WiP:axDlKPhYX2XjzTFSoURhl+9P
TLSH
T10EB126450D41188FE657B63401F6792C701E8E5CAB37B22FB700BEBC7936A789398B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 7bf79ea45235626c1ea7fc4a818506f1f91f4b88a88e5d8793bbfcf356f8de1a
MD5 91c946bac1a8e19c1d326b32a54c7a5f
SHA1 74984c3f381f8038b787dd106cb59fdabfa6e6fb
SHA512 6366436ff51ed7ffb4b02195145468b7ce4f8fe6a1cd2b73726fff87090001e6b37c135953970bc6094fe80b6cbe8ca94c01fe8647e4e2acbe17095436f8ecad
TLSH
T1EC71BA442F83881BE54E0FF79AB9DE1896C508CBD0A4511582B28D47AF05EAC67A63FC
MD5 SHA1 SHA512 TLSH

Submit Download

dafsaData.bin

Path /var/db/nsurlstoraged/dafsaData.bin
Size 56KB
SHA256 ceec06f21c7350cc12d5e56e79bff07ed9bdcbf3f22344a0a30703df6f9f1678
MD5 18342898ca9289afee7db51a6d8447e7
SHA1 48b408dd1904ca0e175129a8b0e8415055910530
SHA512 0a6dfd243e7df49c94f2a7d297f48506090b4b6cfab60a92692d5f5e1c69fbb4ecc523f250a2ab51e3b3d778d766c5986a026793f213280027372190e8cf4f96
SSDEEP 768:jIs6HFz/tldmC2rIxjfNCwi805lzrcb+/+Ppgv2M2V1+KWtHXtd0Hfh5BJJbEf+B:jPA1rg8jkwirzc+G2+/PfjJd0o
TLSH
T10243E1C57395D3893E5372A932026376E15DA1110FBB819CA70F591DCDBEE2F02C925E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

malware,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression
Size 231KB
SHA256 f6f190d00529a24073634bae152790ffdfc2977bead29e718a3d5821086e7bc5
MD5 134970bead4c06e096b8007adeb727a8
SHA1 a3c037138494b12ea596968f521db242dcc6d023
SHA512 143b7cf2c109905c6d22fd356532cdfc70e246c8a708564e4ac53ba71fb19805b8c50454d20ef219bd1859ad91e29312f72921e14ab0883d49dcb2cf86ed4306
SSDEEP 6144:bHukWhKFSLQ9bOnjMiOpysBtNkJj1wr3S28Boj0:bOnhKBbOnQimPBtNWwrC5E0
TLSH
T1733423FE8C717E8D08EE16DAABB6CC694DFD25DC219256783DDA0F358F414A3040BA94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

social_engineering,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression
Size 15.8MB
SHA256 e99c5a89a2356830e84077193bdeb7aab604803da679343921543a63d714f931
MD5 e8f8a40fb9351f7fff2962bedf966c40
SHA1 d4cec324ef28b200c510ab5d18385922bbbd085d
SHA512 a5ab37fa32d4af58efb99b57a81d0f67aa48b6c08b104f2aa85193586708ae58c3364391a3994449a95b5af80967d6a152f19c899a860a6af4975d74a9cb59db
SSDEEP 393216:8f7jqVJn7mcVoKgZuWQ1n6xUm/8xLVoa/cF8DF/V8cstGoWlvH/p4gEWcp:C7jqf2ZVQ1n62Xoas8h/V8A9B4gEDp
TLSH
T157F6337F4AD017FBBD5731EE2906FD34822289061534DE983F4A823A44E95ACCDF06A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unwanted_software,osx,url_expression

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression
Size 107KB
SHA256 d7930ff161d23bcbd3c431b81d964fcc32280fd1974eb876963e1aafdb8e9fe5
MD5 b54b0f3c25baea8f425108207eafa271
SHA1 ba8377635e5c75a9975c0cd6c2342bc379d84181
SHA512 a89bfad89efc60a6d2663331a3ede78b78663db5b96adeb92d29a8ee028db76a999e4d6fe14ce5374bf77a47152a76f9d8062fff036dd7f443e24507be5ca52c
SSDEEP 1536:dtoOcRYEBk4dDBZkudlD7I9770wKhdfJlVBRoaWlB6ifq2vK1P/Zc7Au1vTyk:dt/wBtNrdlOwhLec2Zvc/ZG1vTyk
TLSH
T132B312B8B9593697B3FFB2A909C3E00B073DD6B52FA20C151349B24479852FB49797B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MajorOSInfo.pkg

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/142-28081_EB065869-F129-4506-B8D3-2B0744C65A25/MajorOSInfo.pkg
Size 1.3MB
SHA256 d526a4669f8bb6889a7ccb3802523f597f29e5ac2eae6d8335088b7cf4b69c47
MD5 cb3f87be5ccdbdd5ce74e9433678d244
SHA1 e3a67996f6c9bd614c4009fd65be6e7497dc96a1
SHA512 548b55ef28e0cc19f777e61e5b9869d98e55770564e3ecda55d0b87e84035da5185aa022c8a3b2bb3065351ea629c5265b01baa76e7cf606158cec5b1a76a21a
SSDEEP 24576:Q279JMHv4OoOkILfKkFCpqDhJTuX7q4T4+oaJCMXyaxl/TkSCvxCfkwHAptO4:Q27wP4zOPFCQf947ryC/3CvxCfkwgptD
TLSH
T1035533F8E0F10455C030F93DAEAE8432CE1E3D57561A73BD96499AFB5CA85A49F6C022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Info.plist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/142-28081_EB065869-F129-4506-B8D3-2B0744C65A25/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Info.plist
Size 859B
SHA256 8089e76506793eba9b38183493a0d5ce561e72d9609b37653f4d8fc89448ebe2
MD5 208dc5d75ddbba9b47aaeea6b67631b8
SHA1 6a893e5afc5da520feb82e0ace98579a887f5b88
SHA512 881f174aead31e48dbf117bd0304b034dfd0d4747d7000f3df7c40359c4a51591552ac7d7f4f8a7ecae9c0027282cd63e2c02e9d767ba77d276356d279f7fce2
TLSH
T19E116FF40E5478981CC612D76AD1914E01CC71CC8C7222FEF9C6A618AD0E40563B0AD8
MD5 SHA1 SHA512 TLSH

Submit Download

OSBadge.icns

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/142-28081_EB065869-F129-4506-B8D3-2B0744C65A25/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Resources/OSBadge.icns
Size 1.6MB
SHA256 2e44e080a3bd5c3d3d21495a9eeb49105f2bdfe4a454e4d0361a23bf43f2b6d9
MD5 66df0ace78e06471f4c29f1a45665713
SHA1 254c4b1a5d85669a98538362b8f3334f8e2656e7
SHA512 f0a230a3607961ffe4067164430f40818c3d972a2e2af81767e687c486c2180f9ea622d4aaf48489ffe5afcfdfc552e39a9d3e8741b4e4800021b8d1027e8bd2
SSDEEP 49152:wRz4wGHuRz4wGHQFppD9DmfzCC7CAxCf5wgEva:i8wGI8wGwND9DmfzCC7VxI55R
TLSH
T1807533E5D1F70022C8B9A83E7ADE94738A2F3E52441B77D19588F2EB2CB0A70575D14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Localizable.strings

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/142-28081_EB065869-F129-4506-B8D3-2B0744C65A25/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Resources/en.lproj/Localizable.strings
Size 137B
SHA256 255eb0ade6c48c4972f0e75deefbcadf6868d83a3d7478c09b48bd84ecc60826
MD5 56b3c9731e51466c752f3a2461802ae7
SHA1 cff3765d7139bbc82ed17ed9b87d0a66e64eceb9
SHA512 e99ce17dd5a5a0a36957b75f17129d60ec47ff4f7589d6f422a851ce17bd15a6dadd9eae281f6a78e723c1fd75650f0fb6ea7a4ae6c48f4632214d0a793c6cc4
TLSH
T1D4C02BB3CF469559C00044B45436520CA241E2C8DAA81E201000041518C84420513100
MD5 SHA1 SHA512 TLSH

Submit Download

ProductMetadata.plist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/ProductMetadata.plist
Size 1.2MB
SHA256 0cd0a88f176da40f6ec85255e3e7d494f9a40d08156ba3bcf0015d7d9fa0a90c
MD5 54c30461ceca0cf873d701ee4b160e76
SHA1 1d9cdd540ba3eba1d638470fe30dc0387543e48f
SHA512 599505aa39b51ef697f1bdee1502e8d079c61d380f2edf013caa705cdc22e225ef6961865d986b9677e5065c90cb626a72ea268a5f7044a92cc54bfc87d7ee29
SSDEEP 3072:o/Ae6W+3mYTptqtzuJa4yrsNSyG3neCuiKSx0OEKGAVK424KORCayCSxg14NcREP:ooA+3mYTptqtzuJa4yrsNSTRngP
TLSH
T1E5459AEC895C38296DCE05251CF159990EBEA9DE8C3518FBF2DBA98E748D936C134D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NRM_Events_2026-09-30-14-02-25.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2026-09-30-14-02-25.event
Size 3KB
SHA256 079eeb6e2e4b1db7f6eff9acf8f7282904df5fe559b228addc4c69bf070039d3
MD5 c4048e440360e9f806c4ce730d40ee43
SHA1 f3fd56014c4f530674228b3aceaf11a145b9190b
SHA512 09851364659fe941aac7b50bda6914db13c38f0a87a54d4aba8e9038bb9448ac225b5e48ae9fcd84b1d55227d004b80ef48822545d4e1f9ddd7ed00a7c490ef5
TLSH
T1137165F3FA4138B6C9188575BB5716F3EF08960ABCA859755083CDC845DB7588F0C6C8
MD5 SHA1 SHA512 TLSH

Submit Download

NRM_Events_2026-09-30-14-02-25.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2026-09-30-14-02-25.event
Size 7KB
SHA256 3c6b4d17823e4daff53f9f738629342aeb589642cc7fdc0f09f5c5df6503c549
MD5 7182694b467351c36362e7f17f01cc7b
SHA1 d4218353af502363ded27dd707bec8e2de806483
SHA512 a05cb1fc5c0261eac58ca3abe1accc5a58e8279a096cf633fce7707f570ba9748d02b072cff0ce041a8887c7772a589c7e806b075e35be3cc1f4c611e7c4ae85
SSDEEP 96:pulkEoqtZACZ9qruvN5fq20DpxuulAEoqtZACZpS9ny4m7VtLiLR1pz:s7AKN5iDpxz3AlEVxIR1pz
TLSH
T1E1F186B7F94168B6CD188575BA5312F3EF49920EBCA869795087CDCC44DB758CE0C6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NRM_Events_2026-09-30-14-02-25.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2026-09-30-14-02-25.event
Size 7KB
SHA256 12f9c85d38c8b1bab3c4d8643c58c91753b4973be62bf4060467d4d0fc547618
MD5 6a8aa12aafcf0001f19bf8bc7736cc5d
SHA1 141499dc9cdc888dfe80fda5ed4c9c5110634ec4
SHA512 c663d32c982853077e564ba2df4bb639408b6fbbe656ede845883620424133c076cb1720ea8b326da8554e32e9ede1e93545f4c8799b8b5208c58960d5f450e6
SSDEEP 96:vulkEoqtZACZ9qruvN5fq20DpxuulAEoqtZACZpS9ny4m7VtLiLR1pz:G7AKN5iDpxz3AlEVxIR1pz
TLSH
T1F8F186B7F94168B6CD188575BA5312F3EF49A20EBCA869795087CDCC44DB758CE0C6C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads