MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MioLabStealer

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a
SHA3-384 hash:	c25d6a11f5ca354bd49cb2d171275a2656a5c1d4c0781ea7a92824f4271e9a36c2284bef301579ac24d9769dd6779112
SHA1 hash:	b2a58b71a6461650bc8958d0d6ea01be181e783d
MD5 hash:	90f962d66963f7189a00ad58e88cfd7c
humanhash:	six-delaware-network-robin
File name:	toolset17_stage2_macho.bin
Download:	download sample
Signature	MioLabStealer Create hunting rule
File size:	811'040 bytes
First seen:	2026-11-13 10:32:41 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	12288:ijp0QoUrfLPg7dMqUaAhooQeYief8qfBmPunkT2PC:8pkGtYdf8Lu1C
TLSH	T1B70517173379540ADC1A71387F926DB6FA20B5B66320E89B5E0B1210DFF50789B1A27F
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	harperjohns
Tags:	ClickFix machO macOS MioLabStealer TradingView

harperjohns

macOS stage 2 universal Mach-O (811,040 B) fetched from toolset17[.]tools by the ClickFix curl|bash one-liner of the same 'Setup Center' page. Not analysed beyond strings (no C2 recovered); linkage to the Windows chain is by shared lure page only. Delivered via YouTube lure playlists titled 'TradingView Premium/Desktop Crack 2026' (391 playlists, e.g. https://www.youtube.com/playlist?list=PLY7jZ5Cd4EEr8EWE-eChHVRv4_cnA9FAW ; https://www.youtube.com/playlist?list=PLbQo8q1nBk2Js2Z_qUf36wHN_oeirTMat ; https://www.youtube.com/playlist?list=PLCbqT0D9zM3vR2FpTvnxN_RmE86IDnRYT). Their descriptions link to the community post https://www.youtube.com/post/UgkxpTdnpIRi-_-SuwW1TRffXScjGWsxOZ4P by https://www.youtube.com/@JohnyDodep-t8w -> telegra[.]ph/Always-Work-Link-06-26 -> telegra[.]ph/axldxzx-08-10 ('Setup Center') -> gitlab[.]com/ntaylor6960/dwnlnk/-/raw/main/Installer.zip. macOS branch: telegra[.]ph/macOS-05-17 -> curl|bash from toolset17[.]tools -> universal Mach-O stage 2. More research by the author: https://www.youtube.com/@harperjohnsai and https://youtu.be/UBGt4gP53wU. Static analysis only, nothing executed. -- Harper Johns

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af6e76e83200b505eda629fmacos16vpnfull_triage

Tags:

n/a

Gathering data

Verdict:

Malicious

Labled as:

Mac/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a

Score:

99%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a/

Threat name:

MacOS.Infostealer.Generic

Status:

Suspicious

First seen:

2026-11-13 10:33:17 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

6 of 36 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fnhwdqtux6heu6opo7t3g3iy2hosmxuorfhv6k3nrov4mmr5kvva._file

Malware Family:

stealer

Malicious:

True

Tags:

arm multi-arch macho 64bit self-signed

Link:

https://intel.virussign.com/intelligence/file/2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.