6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

General

Target
file.js
Size 1B
Sample261107-wye2bsfg34
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Score

4^/10

Malware Config

Signatures

Resource Forking 1 TTPs 8 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	LWWeeklyMessageTracer
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Java Updater
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	sidecarPrefCheck
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	AllowPasswordPref
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	walletAvailabilityCheckTool
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	system_installd

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/file.js\""
1⤵
PID:463

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/file.js\""
1⤵
PID:463

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/file.js
1⤵
PID:463
- /bin/zsh
  /bin/zsh -c /Users/run/file.js
  2⤵
  PID:465
- /Users/run/file.js
  /Users/run/file.js
  2⤵
  PID:465
- /bin/sh
  sh /Users/run/file.js
  2⤵
  PID:465
- /bin/bash
  sh /Users/run/file.js
  2⤵
  PID:465

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:450

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:453

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
- Resource Forking
PID:456

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:448

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
- Resource Forking
PID:458

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:496

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:496
- /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
  /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
  2⤵
  - Resource Forking
  PID:500
- /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
  /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
  2⤵
  - Resource Forking
  PID:501
- /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
  /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
  2⤵
  - Resource Forking
  PID:502
- /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
  /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
  2⤵
  - Resource Forking
  PID:503
- /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
  /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
  2⤵
  - Resource Forking
  PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 496
1⤵
PID:498

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:498

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:506

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:507

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:507

/usr/libexec/xpcproxy
xpcproxy com.apple.preferences.softwareupdate.remoteservice 496
1⤵
PID:508

/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
1⤵
PID:508

/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues
/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues -z
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:511

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:512

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:513

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:513

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:515

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
- Resource Forking
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:518

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:534

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.security.agent
1⤵
PID:535

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authhost.00000000-0000-0000-0000-0000000186A5
1⤵
PID:536

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:537

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:537

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tailspin-trace.2026-11-07_18-21-49.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-11-07_18-21-49.tailspin
Size 15.9MB
SHA256 f1eac1024196272dc79563df340968e9384fdcd8182fecedd680e2ee6d264c9a
MD5 b1e078f75ec3eb45f3d67d7f9813ef8a
SHA1 1299ba7e39f7ed9a5db5c3659562a3ccaf70974c
SHA512 bb2fcc73d399db0415adb33458d7d7a3c3eb62c8d1f3d5ce88d095b31f8b65a2c3c14a153089e352751aaeae273ff0f906bb1cc191d744dfa8b3651b4e38ba95
SSDEEP 98304:44yfbEqCPjdd0BA0Mqi1UGNO5gHzE7k26IiQaPIL7kUToW8J2VZ:44U9GLW6krBiQGg7k5Wa2VZ
TLSH
T1F3F68D326C84ADD0CCD6757348E3C7A20FF332F5DD61497681E92FCA6467B064D982AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing