🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MacSync


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e
SHA3-384 hash: 4f501b12ada739fbf499e5620ce67dc0132c0b0d9b0c10188d0c8d0e3420787ae539aa29624f0557adde53ea67636d89
SHA1 hash: d6e4c146ad65606af99b9a8ee684cdf896c2d136
MD5 hash: 7dcec04bd6d1c6c403754cf11387de78
humanhash: bulldog-ink-ink-asparagus
File name:stage1_0e01d720a0e5.zsh
Download: download sample
Signature MacSync
Create hunting rule
File size:1'452 bytes
First seen:2026-10-20 08:24:27 UTC
Last seen:Never
File type:zsh zsh
MIME type:text/x-shellscript
ssdeep 24:1itpg5t1g+n/AJOcE4IwpfDAGrvw3V6OZgnCh389E3kc4snAxqn1RBqlC:11FCOP4I4kGQ6OZgnChM9XmAWBqlC
TLSH T138311B9360C7F6741F81E4F62ED4E5820851EFEC8B12560F98C19AE6C050500D0436FB
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c4ffeine
Tags:ClickFix macOS MacSync stealer zsh


Avatar
c4ffeine
MacSync ClickFix stage-1 zsh (1,452 B) served at https://santaclaracountyproperties.com/curl/28a0700d864a15f5bc551accd41342c59d881f7051555f3ca3a3a5403301628b on 2026-10-20 08:21 UTC to both a browser and a curl User-Agent, fetched via Tor. base64+gzip wrapper evals a stage-2 zsh that sets domain=santaclaracountyproperties.com, curls /dynamic?txd=<token> into osascript and uploads the collected zip in chunks to /gate?buildtxd=<token>. Same /curl token as bankruptcyrhodeisland.com (host rotation); lite build api_key 5190ef17. Not executed.

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Mac.Stealer.1128.15538.12020.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad725725a22ac805bd8107c
Tags:
emotet spawn
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6ad7256cb2d920010607bacf/reports/f695aa72-285c-4a9c-aa9f-bf8ef473c8a8/overview
Verdict:
Malicious
Labled as:
MacStealer.A.Generic
Link:
https://www.hybrid-analysis.com/sample/0e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/0e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e/
Threat name:
MacOS.Trojan.MacSyncStealer
Create hunting rule
Status:
Malicious
First seen:
2026-10-20 08:25:25 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bya5oifa4vc6gy3tnpm3p7d56fbkvxhxkuh7yaa7ayz7rldrrkha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DriveBy Activity
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/0e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAC_Dropper_Shell_Base64Gzip_Heredoc
Create hunting rule
Author:Marjoriefort
Description:Dropper shell (zsh/bash) macOS : payload base64+gzip en heredoc PAYLOAD_, syntaxe BSD base64 -D, decompression inline puis eval/echo/printf
Reference:Grand Scan InTheWild.0440 / 11 misses .sh a structure identique
Rule name:Seedhook_Stage1_Zsh_B64Gzip_Eval
Create hunting rule
Description:Seedhook/MacSync ClickFix stage-1 zsh: gzip+base64 heredoc with randomised PAYLOAD_m delimiter decoded into a $d variable and eval'd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MacSync

zsh zsh 0e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e

(this sample)

  
Link
https://www.virustotal.com/gui/file/0e01d720a0e545e363736bd9b7fc7df142aadcf7550ffc001f0633f8ac718a8e
  
Delivery method
Distributed via web download

Comments