3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce

Analysis

max time kernel
82s
max time network
141s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/11/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce
Size 3.2MB
Sample261102-e5hmcsey7w
SHA256 3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce
MD5 9f97ca2b7d48e45e55fcb644dba3c003
SHA1 ccdca0b82724e7807e78055143a68eef5eebf1bb
SHA512 3a3601d52344b54c1fb6bed9bf84e97c3ed261bc6dc8229320f4688a4ba696dfe763806d71693eae55c49b812f34563d47e7bd3518cdc3d658cf3029d7ad195d
SSDEEP 49152:xczHy0Sh6wAxwuxGBgDTkR+fGhRRVy/5pCcGumZRRlnHkhbi25lYF1O3:6Hyx/yWBgTaz6/CnumRlnHOt5lH
TLSH
T18FF533BDAF3470C2F4AB33F5CAD96126806768561CD6C150AEC48CBC27980E4E6769F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	LWWeeklyMessageTracer
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Java Updater

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce\""
1⤵
PID:461

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce\""
1⤵
PID:461

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce
1⤵
PID:461
- /bin/zsh
  /bin/zsh -c /Users/run/3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce
  2⤵
  PID:464
- /Users/run/3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce
  /Users/run/3b5ab47c36f500bcbbb7c38248dbd40b337108513f8b9ad99e5fe07aecd41fce
  2⤵
  PID:464

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:450

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:453

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
- Resource Forking
PID:456

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:447

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
- Resource Forking
PID:457

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads