11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d

Analysis

max time kernel
38s
max time network
40s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
24/10/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d.macho
Size 2.0MB
Sample261024-ejbxpahw5r
SHA256 11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d
MD5 6ee5ab4fb1fc5de02be7c22460e16675
SHA1 bbc62d64bf1aaefb3dcc3d726c8a5d4692017212
SHA512 3af7e7cfa2fa561636de5d6363ea3279fa60ae7bb42896740642915ee57bfa4339edfdc3d24d5e7d2e755e8483f31d32cbee9dcaa5cc6de55712a205102d5b0f
SSDEEP 24576:5E8zAtqMjQ2puLRDiQxJC7yQd3sweLllgljEDdeaZvGgtJAI53rZv3tF4D+s4NPQ:UM84C7Bs9BCEDFgBS9bg274lH8AvVwBY
TLSH
T101A5E0204E1F3186D00611739C990F9C85B468B0CD0EEDEA9741B36AEE3A7D777626B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	LWWeeklyMessageTracer
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Java Updater

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d.macho\""
1⤵
PID:462

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d.macho\""
1⤵
PID:462

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d.macho
1⤵
PID:462
- /bin/zsh
  /bin/zsh -c /Users/run/11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d.macho
  2⤵
  PID:464
- /Users/run/11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d.macho
  /Users/run/11387a0d240ca6a184d4fd7524e63661012b26a51926ba6562fd7d966ad1b23d.macho
  2⤵
  PID:464

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:448

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:451

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
- Resource Forking
PID:454

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:446

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
- Resource Forking
PID:457

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads