Overview

overview

6

Static

static

1

Disk Drill...T].dmg

macos-10.15-amd64

4

Disk Drill...T].dmg

macos-10.15-amd64

4

Disk Drill....dylib

macos-10.15-amd64

1

Disk Drill....dylib

macos-10.15-amd64

1

Disk Drill....dylib

macos-10.15-amd64

1

Disk Drill... Drill

macos-10.15-amd64

1

Disk Drill....dylib

macos-10.15-amd64

1

Disk Drill....dylib

macos-10.15-amd64

1

Disk Drill....dylib

macos-10.15-amd64

1

Disk Drill...fbackd

macos-10.15-amd64

4

Disk Drill...redisk

macos-10.15-amd64

4

Disk Drill...redisk

macos-10.15-amd64

4

Disk Drill...anager

macos-10.15-amd64

4

Disk Drill...es/adb

macos-10.15-amd64

4

Disk Drill...64_arm

debian-12-armhf

Disk Drill...rm_pie

debian-12-armhf

Disk Drill...64_x86

ubuntu-18.04-amd64

Disk Drill...86_pie

ubuntu-18.04-amd64

Disk Drill...fb-adb

macos-10.15-amd64

4

Disk Drill....dylib

macos-10.15-amd64

4

Disk Drill...ake_ro

ubuntu-18.04-amd64

1

Disk Drill...ake_ro

debian-9-armhf

1

Disk Drill...ake_ro

debian-9-mips

1

Disk Drill...ake_ro

debian-9-mipsel

1

Disk Drill...ake_rw

ubuntu-18.04-amd64

1

Disk Drill...ake_rw

debian-9-armhf

1

Disk Drill...ake_rw

debian-9-mips

1

Disk Drill...ake_rw

debian-9-mipsel

1

Disk Drill...runner

macos-10.15-amd64

4

Disk Drill...nstall

ubuntu-18.04-amd64

6

Disk Drill...nstall

debian-9-armhf

6

Disk Drill...nstall

debian-9-mips

6

Analysis

  • user interaction
    yes
  • max time kernel
    143s
  • max time network
    192s
  • platform
    macos-10.15_amd64
  • resource
    macos-20260915-en
  • resource tags

    arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    30/10/2026, 18:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Disk Drill 4.6/Manual install/Disk Drill 4.6 [TNT].dmg
  • Size 88.0MB
  • Sample261030-xdhr6aev9v
  • SHA256 508fb3ebb5ec51af619101a695f09c9da2b60788cf0b2eb01672972e63ebc114
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
defense_evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 4 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"open /Volumes/Disk\\ Drill\\ 4.6/Disk\\ Drill.app\""
    1⤵
      PID:521
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"open /Volumes/Disk\\ Drill\\ 4.6/Disk\\ Drill.app\""
      1⤵
        PID:521
      • /usr/bin/sudo
        sudo /bin/zsh -c "open /Volumes/Disk\\ Drill\\ 4.6/Disk\\ Drill.app"
        1⤵
          PID:521
          • /bin/zsh
            /bin/zsh -c "open /Volumes/Disk\\ Drill\\ 4.6/Disk\\ Drill.app"
            2⤵
              PID:522
            • /usr/bin/open
              open "/Volumes/Disk Drill 4.6/Disk Drill.app"
              2⤵
                PID:522
            • /usr/libexec/xpcproxy
              xpcproxy com.cleverfiles.DiskDrill.2332
              1⤵
                PID:524
              • /Volumes/Disk Drill 4.6/Disk Drill.app/Contents/MacOS/Disk Drill
                "/Volumes/Disk Drill 4.6/Disk Drill.app/Contents/MacOS/Disk Drill"
                1⤵
                  PID:524
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.spindump
                  1⤵
                    PID:527
                  • /usr/sbin/spindump
                    /usr/sbin/spindump
                    1⤵
                      PID:527
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.spindump_agent
                      1⤵
                        PID:528
                      • /usr/libexec/spindump_agent
                        /usr/libexec/spindump_agent
                        1⤵
                          PID:528
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.DesktopServicesHelper.94AD94B6-D241-4D9B-B30F-8531EB528B40
                          1⤵
                            PID:529
                          • /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
                            /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
                            1⤵
                            • Resource Forking
                            PID:529
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.replayd
                            1⤵
                              PID:533
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.ReportMemoryException
                              1⤵
                                PID:535
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.system_installd
                                1⤵
                                  PID:537
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.storedownloadd
                                  1⤵
                                    PID:538
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.installd
                                    1⤵
                                      PID:539
                                    • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                      /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                      1⤵
                                      • Resource Forking
                                      PID:537
                                    • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                      /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                      1⤵
                                      • Resource Forking
                                      PID:539
                                    • /usr/libexec/replayd
                                      /usr/libexec/replayd
                                      1⤵
                                        PID:533
                                      • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                        /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                        1⤵
                                        • Resource Forking
                                        PID:538
                                      • /usr/libexec/ReportMemoryException
                                        /usr/libexec/ReportMemoryException
                                        1⤵
                                          PID:535
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.Safari.CacheDeleteExtension 531
                                          1⤵
                                            PID:541
                                          • /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                            /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                            1⤵
                                              PID:541
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.Safari.CacheDeleteExtension 531
                                              1⤵
                                                PID:550
                                              • /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                1⤵
                                                  PID:550

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      tailspin-trace.2026-10-30_18-59-14.tailspin
                                                      • Path /private/var/db/spindump/tailspin-trace.2026-10-30_18-59-14.tailspin
                                                      • Size 16.0MB
                                                      • SHA256 85ad4d14ea9088056e4499bf9044d1e6792d8bb45ac125cb69a269096bb0649b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download