MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c0cc8b60e502e9a2a82a1a6acdfa340ff43608dd6fdad32db9ce99b383513e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2c0cc8b60e502e9a2a82a1a6acdfa340ff43608dd6fdad32db9ce99b383513e3
SHA3-384 hash:	9b4c4423b5c087c8d4f0cb877f521e6d7eb0e95b627e30620dd736bb5953b7f0676e76083cac35512301e721a75bc568
SHA1 hash:	eb061510eae45ebb9ce5f52df5e35b3a573152c4
MD5 hash:	be4459aef66bcbc4e1478a2974aa3d6d
humanhash:	purple-enemy-uncle-six
File name:	Evolion.pkg
Download:	download sample
File size:	3'020'511 bytes
First seen:	2023-07-06 14:34:50 UTC
Last seen:	Never
File type:	unknown
MIME type:	application/x-xar
ssdeep	49152:S3Dpdl1iSHW8OPImWLTGfz3UJAgSU3rBOeXfB0BLmrbYeEWVeW9Pc5PtEQIl1wsa:S17HWpySfz3UN31OeXJ0gbYevdc5VHIs
TLSH	T132E5334E5944B7884315D23ACCBB04CE17ACDBFEB1269D1623CF7B2947C286A856CDC6
Reporter	iamdeadlyz
Tags:	macOS pkg RealstStealer

Iamdeadlyz

Fake Blockchain Games Deliver RedLine Stealer & Realst Stealer - A New macOS Infostealer Malware
https://iamdeadlyz.gitbook.io/malware-research/july-2023/fake-blockchain-games-deliver-redline-stealer-and-realst-stealer-a-new-macos-infostealer-malware

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

113

Origin country :

SG

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Variant.Trojan.MAC.Stealer.5.21721.30988.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.MAC.Generic.112644.16363.3776.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Application.MAC.Generic.1635.16386.27128.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/64a6d118bf106cbffd3751ae/reports/3e9596ab-936d-48fc-8ca2-ffd3cc5c8ca2/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2c0cc8b60e502e9a2a82a1a6acdfa340ff43608dd6fdad32db9ce99b383513e3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2c0cc8b60e502e9a2a82a1a6acdfa340ff43608dd6fdad32db9ce99b383513e3/

ReversingLabs TitaniumCloud MacOS.Trojan.MalSource

Threat name:

MacOS.Trojan.MalSource

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-06 14:35:07 UTC

File Type:

Binary (Archive)

Extracted files:

17

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fqgmrnqokaxjukucugtkzx5did7ugyen23622mw3ttuzwobvcprq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2c0cc8b60e502e9a2a82a1a6acdfa340ff43608dd6fdad32db9ce99b383513e3