Verify the SHA-256 hash to ensure file integrity.

Check the codesign details to see if the app is signed or ad-hoc signed.

Watch for hidden files created in /private/tmp/ or ~/Library/ .

Monitor traffic for calls to external Command & Control (C2) servers.

⚠️ Always perform your analysis in a disconnected virtual machine (like a macOS VM or a dedicated sandbox) to prevent accidental execution on your host system.