MalwareBazaar Database

This page shows some basic information the YARA rule MAC_Dropper_Shell_Base64Gzip_Heredoc including corresponding malware samples.

Database Entry

YARA Rule:MAC_Dropper_Shell_Base64Gzip_Heredoc
Create hunting rule
Author:Marjoriefort
Description:Dropper shell (zsh/bash) macOS : payload base64+gzip en heredoc PAYLOAD_, syntaxe BSD base64 -D, decompression inline puis eval/echo/printf
Firstseen:2026-09-20 13:14:27 UTC
Lastseen:2026-10-20 19:26:45 UTC
Sightings:13

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter