File:IPA.png

Image shows the diagram of how bundle executable calls posix_spawn and loads main payload that establishes connection with an attacker.