MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d5c59fb86a094f4b2d5c170e9fa4a8c401de6267b6d6cd12af45003690aba0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	0d5c59fb86a094f4b2d5c170e9fa4a8c401de6267b6d6cd12af45003690aba0b
SHA3-384 hash:	40000dd9e12fff21cca48834f121bab4e5bc84ca66c3ad8d0b414632f3d5adaf477604f8b0609ce5d1836dff94511dbd
SHA1 hash:	8430d3b850878a35fbfc70f5883d7eacdb0d0bd0
MD5 hash:	ff74b4e0dd2096030d7a797ba0825590
humanhash:	quebec-alaska-early-hotel
File name:	App.bin
Download:	download sample
File size:	118'960 bytes
First seen:	2025-10-23 02:26:20 UTC
Last seen:	2025-10-25 10:17:10 UTC
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	192:6Sjga/QjyMSIRdei4LvZ6fgvxrVBatkeFa3aVqm9vC0BQNzbL8fXxxnVlgatkep:6SjgqJMdDeipWxhb3apvC0BGI5xVlF
TLSH	T185C3B52263181831C08EC33CD6FF172DD6B1F65166A2936B2F46C93C6FE8354E660D46
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	BlinkzSec
Tags:	machO

BlinkzSec

The script downloads the file mentioned here:
https://bazaar.abuse.ch/sample/6f5965e5a6f0dde8d32a6f6fdffa60cb02d782633d73be6fdd2e4b786bcdbdaf/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68f992653edd081eba40f07b

Tags:

ransomware infosteal

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade obfuscated

Link:

https://www.filescan.io/uploads/68f9926311ff3db29f66b722/reports/2840d644-1fab-40f3-a6a4-71d3382dd810/overview

Verdict:

Suspicious

Labled as:

Malware_

Link:

https://www.hybrid-analysis.com/sample/0d5c59fb86a094f4b2d5c170e9fa4a8c401de6267b6d6cd12af45003690aba0b

Verdict:

Clean

File Type:

macho fat

First seen:

2025-10-23T08:27:00Z UTC

Last seen:

2025-10-23T11:26:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0d5c59fb86a094f4b2d5c170e9fa4a8c401de6267b6d6cd12af45003690aba0b/results?tab=lookup

Score:

95%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/0d5c59fb86a094f4b2d5c170e9fa4a8c401de6267b6d6cd12af45003690aba0b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0d5c59fb86a094f4b2d5c170e9fa4a8c401de6267b6d6cd12af45003690aba0b/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/0d5c59fb86a094f4b2d5c170e9fa4a8c401de6267b6d6cd12af45003690aba0b

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2025-10-23 02:13:31 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

4 of 24 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bvoft64guckpjmwvyfyot6skrrab3zrgpnwwzujk6riag2ikxifq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0d5c59fb86a094f4b2d5c170e9fa4a8c401de6267b6d6cd12af45003690aba0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_XORed_Mozilla_Oct19 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.
Reference:	https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()

Rule name:	SUSP_XORed_Mozilla_RID2DB4 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed keyword - Mozilla/5.0
Reference:	Internal Research