Analysis
- max time kernel
148s - max time network
103s - platform
macos-10.15_amd64 - resource
macos-20260915-en - resource tags
- submitted
04/11/2026, 18:14
General
- Target darwin_amd64
- Size 33KB
- Sample261104-wvprcsb16v
- SHA256 22be9cb39c5c9e0f227b747ed45fc175bdb2d2e1613e29f15db61c4f9943e8d6
Score
4/10
Malware Config
Signatures
- Resource Forking 1 TTPs 2 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/darwin_amd64\""1⤵
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/darwin_amd64\""1⤵
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/darwin_amd641⤵
-
/bin/zsh/bin/zsh -c /Users/run/darwin_amd642⤵
-
-
/Users/run/darwin_amd64/Users/run/darwin_amd642⤵
-
-
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd1⤵
-
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer1⤵
- Resource Forking
-
/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"1⤵
-
/usr/libexec/pkreporter/usr/libexec/pkreporter1⤵
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck1⤵
- Resource Forking
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵
-
/usr/sbin/spindump/usr/sbin/spindump1⤵