djay Pro 5.6 highlighted as a malicious application

  • Device model *: Macbook Pro M1
  • Version of operating system *: macOS 15.7
  • Version of djay *: 5.6
  • Hardware/controllers used *: N.A.

A) SUMMARY OF ISSUE:
Security application SentinelOne sees DJAY Pro App version 5.6 as a malicious application and instantly deletes it not allowing to run the application.

B) DETAILED STEPS TO REPRODUCE:
Install SentinelOne security app → Update to DJAY Pro 5.6 from the Appstore → Open the application → Instantly deleted

C) EXPECTED RESULTS:
DJAY Pro should run and not be highlighted as an insecure application especially if it is downloaded from the Appstore. There might be scripts running in the background with the new update that highlights the application as malicious.

D) ACTUAL RESULTS:
The application is instantly deleted by the security sofrware.

Hi @dj_taken, every djay update on the App Store is reviewed and vetted by Apple. So, as long as you are using the official Apple App Store there should be no concerns. We recommend that you contact SentinalOne customer support to see what they suggest. Sorry I couldn’t be of more help.

Hey @Slak_Jaw, thanks for getting back to me.
I’ve reached out to them as well. Let’s see what they will say.

Is there anyway for me to access older DJAY Pro versions? I know the Appstore doesn’t allow this, but do you publish your builds somewhere like Testflight where I can get access to it so I can get unblocked for the time being?

You’re welcome @dj_taken. The only way to access previous djay versions is if you have a full system backup using something like TimeMachine.

1 Like

I got more information on the issue from the Security team, and it seems like SentinelOne saw DJAY Pro as a malicious software because of the following:

Detected by: SentinelOne EDR
Alert name: VSearch detected.
File name: djay Pro
File path: /Applications/djay Pro.app/Contents/MacOS/djay Pro
Originating process: launchd
Command line arguments: /Applications/djay Pro.app/Contents/MacOS/djay Pro
Indicator Category: Malware
Indicator Description: File is a VSearch variant
Indicator Metadata: TrueContextID: A3F1090E-394E-487B-BC6B-536770CAD923, Process to process relation: OSParent. To djay Pro: 44879 (70E4A514-EA9D-4C66-A9C0-E79909E369E8)
Indicator Name: VSearch
SHA1: 8e7cb424fca3a2f82288c031b97ef35c45edff68
SHA256: 10948ca61f77eb112c2559cdc93687d76ee5f4fd8477cd757af86e8d5e2dc471

I hope this helps on your end, we had to white-list the app for it to work for now.

1 Like

Thanks for sharing @dj_taken. I’ll share this with our engineering team.

1 Like