MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1
SHA3-384 hash: fd0f531681109306a806c2aefbaa2f37b55f46bbc461c02e3cb04b413f9bd3356878df064c77deb3d9205332c568faa7
SHA1 hash: 43f987c15ae67b1183c4c442dc3b784faf2df090
MD5 hash: 470275eaf344be97f9950c4c42a783ef
humanhash: paris-winner-alabama-edward
File name:Discord
Download: download sample
File size:157'728 bytes
First seen:2023-11-01 17:24:07 UTC
Last seen:Never
File type:php macho
MIME type:application/x-mach-binary
ssdeep 3072:nSRFCx9UrrA30VtDs9UrrA30Vtl49UrrA3O9UrrA3:nS+x9UrrA30VtDs9UrrA30Vtl49UrrAI
TLSH T190F3FA837F581195C06C913A825FA7214033FF86AF07A2577764E6286EF73755A03ACB
TrID 82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5)
17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Reporter smica83
Tags:HLoader machO macOS

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mac.DownLoad.32.10086.28467.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/654289f8a6fa5eab936d0387/reports/94292046-4ec5-4f06-89ef-1251c3d15515/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1/
Threat name:
MacOS.Trojan.HLoader
Create hunting rule
Status:
Malicious
First seen:
2023-10-14 22:35:48 UTC
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=enqknhs724qx5f3repeb2pn3mc7uoy5j3ltjjg6bsabdj53wfxyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:XCSSET_Strings
Create hunting rule
Author:@is_henderson
Description:Rule based on deob strings - easymode

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn

Comments