fc4febecf3fc7b6de0b00ad611639a17b97fc8af9ac9db43485853ddbc398483

Login
Reports

Overview

overview

Static

static

Payload/Te...ts.pdf

macos-10.15-amd64

Payload/Te...gue.js

macos-10.15-amd64

Payload/Te...dle.js

macos-10.15-amd64

Payload/Te...x.html

macos-10.15-amd64

Payload/Te...rs.ps1

macos-10.15-amd64

Payload/Te....dylib

macos-10.15-amd64

Payload/Te...c.html

macos-10.15-amd64

Payload/Te...ipt.js

macos-10.15-amd64

Payload/Te...r.html

macos-10.15-amd64

Payload/Te...m.html

macos-10.15-amd64

Payload/Te...ension

macos-10.15-amd64

Payload/Te...ts.pdf

macos-10.15-amd64

Payload/Te...ension

macos-10.15-amd64

Payload/Te...ension

macos-10.15-amd64

Payload/Te...sionv1

macos-10.15-amd64

Payload/Te...ension

macos-10.15-amd64

Payload/Te...ts.pdf

macos-10.15-amd64

Payload/Te...ension

macos-10.15-amd64

Payload/Te...ity.js

macos-10.15-amd64

Payload/Te...ode.js

macos-10.15-amd64

Payload/Te...legram

macos-10.15-amd64

Payload/Te...h.html

macos-10.15-amd64

Payload/Te...ipt.js

macos-10.15-amd64

Payload/Te...rch.js

macos-10.15-amd64

Payload/Te...o.html

macos-10.15-amd64

Payload/Te...ipt.js

macos-10.15-amd64

Payload/Te...e.html

macos-10.15-amd64

Payload/Te...ipt.js

macos-10.15-amd64

Payload/Te...ute.js

macos-10.15-amd64

Payload/Te...le.ps1

macos-10.15-amd64

Payload/Te...hls.js

macos-10.15-amd64

Payload/Te...min.js

macos-10.15-amd64

Analysis

max time kernel
121s
max time network
112s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
01/10/2026, 10:13

Sharing

Copy URL Twitter E-mail

Static task

static1

Behavioral task

behavioral1

Sample

Payload/Telegram.app/Frameworks/TelegramUIFramework.framework/Assets.pdf

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

Payload/Telegram.app/Frameworks/TelegramUIFramework.framework/HlsBundle.bundle/headless_prologue.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

Payload/Telegram.app/Frameworks/TelegramUIFramework.framework/HlsBundle.bundle/index.bundle.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

Payload/Telegram.app/Frameworks/TelegramUIFramework.framework/HlsBundle.bundle/index.html

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

Payload/Telegram.app/Frameworks/TelegramUIFramework.framework/LibprismaBundle.bundle/grammars.ps1

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

Payload/Telegram.app/Frameworks/libswift_Concurrency.dylib

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

Payload/Telegram.app/Generic.html

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Payload/Telegram.app/GenericUserScript.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Payload/Telegram.app/HLSVideoPlayer.html

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Payload/Telegram.app/Instagram.html

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

Payload/Telegram.app/PlugIns/BroadcastUploadExtension.appex/BroadcastUploadExtension

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

Payload/Telegram.app/PlugIns/IntentsExtension.appex/Assets.pdf

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

Payload/Telegram.app/PlugIns/IntentsExtension.appex/IntentsExtension

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

Payload/Telegram.app/PlugIns/NotificationContentExtension.appex/NotificationContentExtension

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

Payload/Telegram.app/PlugIns/NotificationServiceExtensionv1.appex/NotificationServiceExtensionv1

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

Payload/Telegram.app/PlugIns/ShareExtension.appex/ShareExtension

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

Payload/Telegram.app/PlugIns/WidgetExtension.appex/Assets.pdf

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

Payload/Telegram.app/PlugIns/WidgetExtension.appex/WidgetExtension

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

Payload/Telegram.app/Readability.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

Payload/Telegram.app/ReaderMode.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

Payload/Telegram.app/Telegram

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

Payload/Telegram.app/Twitch.html

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

Payload/Telegram.app/TwitchUserScript.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

Payload/Telegram.app/UIWebViewSearch.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

Payload/Telegram.app/Vimeo.html

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

Payload/Telegram.app/VimeoUserScript.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

Payload/Telegram.app/Youtube.html

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

Payload/Telegram.app/YoutubeUserScript.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

Payload/Telegram.app/anim_storymute.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

Payload/Telegram.app/en.lproj/Localizable.ps1

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

Payload/Telegram.app/hls.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

Payload/Telegram.app/purify.min.js

Resource

macos-20260915-en

macos-10.15-amd64

0 signatures

150 seconds

Report Analysis Logs

General

Target
Payload/Telegram.app/GenericUserScript.js
Size 666B
Sample261001-l9gn7aware
SHA256 fc4febecf3fc7b6de0b00ad611639a17b97fc8af9ac9db43485853ddbc398483
MD5 034ab8c740205e7af543a4a9bd92b91b
SHA1 3ab14366d83497441f6878fc6d86abdf75a76c03
SHA512 5b12394d9c0c7e86933a01916449cc159efb80231085efa590f6ac9040ec48c92df0ac90068ad5eabaf3bf97a21e4aacd55a74c0c91b544b2fbc661c8a1bce51
TLSH
T179014C5E94D33476595F112E7F9E700030645CA7024DEA41BD5DCDF11F94D602670BC9
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Processes

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/Telegram.app/GenericUserScript.js\""
1⤵
PID:494

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Payload/Telegram.app/GenericUserScript.js\""
1⤵
PID:494

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Payload/Telegram.app/GenericUserScript.js
1⤵
PID:494
- /bin/zsh
  /bin/zsh -c /Users/run/Payload/Telegram.app/GenericUserScript.js
  2⤵
  PID:495
- /Users/run/Payload/Telegram.app/GenericUserScript.js
  /Users/run/Payload/Telegram.app/GenericUserScript.js
  2⤵
  PID:495
- /bin/sh
  sh /Users/run/Payload/Telegram.app/GenericUserScript.js
  2⤵
  PID:495
- /bin/bash
  sh /Users/run/Payload/Telegram.app/GenericUserScript.js
  2⤵
  PID:495

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads