sshd

executablemacOS745.3 KBx86_64, arm64

System telemetry collector — gathers diagnostics and performance data for Apple

Collects system diagnostics, performance metrics, and usage telemetry from the local machine. Communicates with 11 network endpoints to transmit diagnostic data and telemetry to Apple servers. Exposes an XPC service for other system components to submit diagnostic information. Monitors 22 bundle identifiers and accesses 20 file paths to gather information about installed applications and system state. Runs continuously as a system daemon.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 745.3 KB
UUID: F597EE31-EE55-3A68-A453-1EF117DB3E32
Analyzed: 2026-04-07T05:21:15Z
CDHash: 36283b225bbae80c4b3ca497e85ad97456438e5f97a817a9e6a9029fbcda28a9

Frameworks11

Foundation Kerberos OpenDirectory libEndpointSecuritySystem.dylib(weak)libManagedConfigurationFiles.dylib(weak)libbsm.0.dylib libcrypto.46.dylib libpam.2.dylib libresolv.9.dylib libz.1.dylib libSystem.B.dylib

Entitlements2

com.apple.private.endpoint-security.submit.opensshtrue

com.apple.private.security.clear-library-validationtrue

Interesting Strings

Bundle IDs(22)

/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/addrmatch.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth2-methods.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/authfd.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/authfile.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/canohost.c

File Paths(20)

/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/addrmatch.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth2-methods.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/authfd.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/authfile.c /AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/canohost.c

telemetry(2)

2com.apple.private.endpoint-security.submit.openssh <key>com.apple.private.endpoint-security.submit.openssh</key>

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

Endpoints(11)

HostnameOpenSSH-354.0.3

Hostnameopenssh.com

Hostnamelibssh.org

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

0

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

2

File Paths

20

Bundle IDs

22

IOKit Constants

0

Library Functions

2

Structural HashesSHA-256

Codec9526b35cdcb75be5d1cb1dff96849ef173ddec4d4915c442349630bfcc1b0d5

Importsff90b70a2749817819ffa7eca1ab5de92c695baca29d0f6f1f180f107c4c4752

Frameworksf23114c2c58c78487879b82f97f2c6e3882992d6198ff8f21b1e35fa79f8ea9d

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements192a5050d79c3de379037b6ec404ce9c5591fee08fdf666c27d46c1f098e0168

Symbolsff90b70a2749817819ffa7eca1ab5de92c695baca29d0f6f1f180f107c4c4752

Static Libraries2 / 421 functions identified

Identified Libraries

ssh 0.11.3 (2 fn)

Function Matches(2)

PEM_read_bioopenssl 3.2High

PEM_read_bioopenssl 3.2High

Functions(421)

0x1000009f0sub_1000009f0

0x100000a90sub_100000a90

0x100000ad4sub_100000ad4

0x100000c28sub_100000c28

0x100000c6csub_100000c6c

0x100000c74sub_100000c74

0x100000e24sub_100000e24

0x100000e2csub_100000e2c

0x100000f78sub_100000f78

0x100000fe0sub_100000fe0

0x100001008sub_100001008

0x1000011a0sub_1000011a0

0x1000012b0sub_1000012b0

0x100001320sub_100001320

0x1000013b0sub_1000013b0

0x1000015d4sub_1000015d4

0x100001894sub_100001894

0x100001934sub_100001934

0x1000019ccsub_1000019cc

0x100001a78sub_100001a78

Imports270 symbols from 4 dylibs

libSystem.B.dylib149 libcrypto.46.dylib118 libresolv.9.dylib2 libManagedConfigurationFiles.dylib1

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

ssh-apple-pkcs11