Bintracer

Detonate Mach-O binaries, app bundles, and dylibs. Extract DMG and PKG files. Analyze JXA, AppleScript, Python, Perl, and shell scripts.

Analyze a sampleView a malware report

PDF-Brain.dmg

Apple disk image

The PDF-Brain app executed, creating temporary Metal, GPU, Flutter-engine cache, and CFNetwork download files, and issued DNS queries for etoftheappyrince.org and atsheisdomestic.org.

Network IOCs
2 domains
Captured files
24 artifacts
Code signing
Unsigned
etoftheappyrince.orgatsheisdomestic.org
644fc49fa1006a2a2acace694e5fb83753164e2617051ece6d9dc9ea32329e70
Open scan

Popular reports

PDF-Brain.dmg

Apple disk image

The PDF-Brain app executed, creating temporary Metal, GPU, Flutter-engine cache, and CFNetwork download files, and issued DNS queries for etoftheappyrince.org and atsheisdomestic.org.

Network IOCs
2 domains
Captured files
24 artifacts
Code signing
Unsigned
etoftheappyrince.orgatsheisdomestic.org
644fc49fa1006a2a2acace694e5fb83753164e2617051ece6d9dc9ea32329e70
Open scan

Maccy.dmg

Apple disk image

The sample launched /usr/bin/osascript via /bin/zsh to run Maccy.scpt; osascript queried api.live-updates.online and modified cache and HTTP storage files under the user's Library directories.

Process chain
zsh → osascript
Network IOCs
1 domain
Captured files
2 artifacts
api.live-updates.onlineMaccy.scpt
2b512f6c393edad89a89ecafe26cd23b71cfdd271c10522f8dba98997ebf39bb
Open scan

Werkbit.dmg

Apple disk image

The sample executed its veltod binary, resolved raw.githubusercontent.com, and attempted a TLS connection to that host over port 443 while modifying temporary and user cache database files.

Code signing
Revoked
Network IOCs
1 domain, 9 IPs
Captured files
4 artifacts
raw.githubusercontent.comveltod
3a9d703ba7f7564399365db7ab8b04238806ef7a53df0b6822f32b80bf0f5a80
Open scan

Sandbox features

Deep visibility into macOS malware

Purpose-built macOS environments
Supports Mach-O binaries, dylibs, app bundles, DMGs, PKGs, AppleScript, JXA, Python, Perl, and shell scripts.
Fine-grained execution controls
Tune code-signing behavior, disable SIP, and enable function hooks for deeper instrumentation.
Custom detection rules
Run your own YARA and EQL rules alongside Bintracer rulesets while keeping proprietary detections private.
AI enrichment
Turn rule hits, artifacts, and behavioral signals into concise analyst summaries for faster triage.

Pricing

Sandbox plans for individuals and teams

Analyst

40% off first year

$59 /month · $99

Private analyses, BYO YARA and EQL rules, 5-minute VM timeout.

Free

For public research and one-off triage.

$0forever

  • Public analysis and results
  • 10 analyses per month
  • Bintracer YARA and EQL rules
  • 30 second VM timeout
  • macOS Tahoe (Apple Silicon ARM64)
Start free

Analyst

Most popular

For independent researchers who need private results.

$99$59per month

40% off for our first year, through August 2027

  • Private analysis and results
  • 50 private analyses per month
  • BYO YARA and EQL rules
  • 5 minute VM timeout
  • Disable SIP/AMFI
  • Read-only API access (coming soon)
  • macOS Tahoe, Sequoia, or Sonoma (Apple Silicon ARM64)

Team

For teams that need a shared workspace and pooled volume.

$499$299per month

Billed annually

  • Everything in Analyst, plus:
  • 5 seats on a shared workspace
  • 500 private analyses per month
  • Full API access (coming soon)
  • Shared team scans and rules
  • 10 minute VM timeout
  • Annual commitment, invoiced
Contact sales

Enterprise

For organizations that need managed access, dedicated support, and volume beyond the Team plan.

Contact us

Book a demo
  • 2500+ private analyses per month
  • Unlimited seats with custom policies
  • Single Sign-On (SAML / OIDC)
  • SCIM user provisioning
  • Role-based access control
  • Volume discounts
  • Dedicated support & SLA
  • Full API access (coming soon)