ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9

Analysis

max time kernel
37s
max time network
40s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
02/11/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9.macho
Size 1.8MB
Sample261102-ejv1kazyas
SHA256 ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9
MD5 d369b210f8dc4d7af2d1f489d59d4c91
SHA1 7f9a895d88aa56323b8f2e6f524fd88e154f3ee3
SHA512 3b4ce1c4ce2b7846e5a55edd3c506fb8aa75cd3de3991a99648123daa05f139a8469f102cc990efb69eb12e0924a54213a316a0d262ed5ff4a9b5b3ffb492a35
SSDEEP 24576:14Myt2Ooy1N6BDYT23sMFoNQ0cJisPA+b6gTMGEKvcBv0kiAMyPsN6dnD9OBn+rP:1jzHGvwSuMeBkiLyPsNcDUBME00ML
TLSH
T1CD850228562752ACE502177A9C540FD114A2A3E12E047FFA2B15F7F52D30EE7FA62372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	LWWeeklyMessageTracer
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Java Updater

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9.macho\""
1⤵
PID:461

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9.macho\""
1⤵
PID:461

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9.macho
1⤵
PID:461
- /bin/zsh
  /bin/zsh -c /Users/run/ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9.macho
  2⤵
  PID:464
- /Users/run/ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9.macho
  /Users/run/ba2fb68385233683f785e3bae69cb79360a2a6c48b43b44f9c43a3b8f54ca1a9.macho
  2⤵
  PID:464

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:448

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
- Resource Forking
PID:454

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:451

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:446

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
- Resource Forking
PID:457

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads