🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a5e7a1e5d4394d3a4fce80595dfc03301d3d6cce55094bd34a2de7b1c2c814c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a5e7a1e5d4394d3a4fce80595dfc03301d3d6cce55094bd34a2de7b1c2c814c
SHA3-384 hash: f02d5db2b4aad8c8de8229b8a3bb1ffd32cd52b7497a06b1ee5cc69290fdf7b508540a335728ec5d9b33f13966d2a43c
SHA1 hash: 1b4809095ac9817e4909439f688be3ec4ab9d3bf
MD5 hash: 8dbb34c2d078ae36a8f41a07594c9b78
humanhash: happy-aspen-glucose-solar
File name:macho_3a5e7a1e5d43.bin
Download: download sample
File size:12'266'240 bytes
First seen:2026-09-30 23:44:44 UTC
Last seen:2026-09-30 23:44:51 UTC
File type:php macho
MIME type:application/x-mach-binary
ssdeep 196608:RfAf4i7PAE9WL62ceJUERzMedZEFggwDmtH3E9WL62ceJUUfzNV:RIwi7PAE9WL62ceJU2zJdZE+gwDm53EW
TLSH T11EC67EB5643CD81ED083E0F87A8B87E27D09F46003B0514737A57F6DBE64E5019ADBAA
TrID 82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5)
17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika macho
Reporter c4ffeine
Tags:ClickFix Mach-O machO macOS


Avatar
c4ffeine
12,266,240 B universal Mach-O (x86_64 + arm64) served with HTTP 200 as an application/octet-stream attachment at https://sandiegomobiletire.com/loader/agent/a75137e5a3f45aacaa1ed5259e81ad8dcbcc0c1b767d8fc46dc42d2ef548b449 to both a curl/8.7.1 and a Safari User-Agent, fetched via Tor 2026-09-30 23:40 UTC. The domain is an expired small-business name re-registered 2026-03-03 at Unstoppable Domains and fronted by Cloudflare. Not executed, not yet analysed; family attribution pending.

Intelligence

File Origin
# of uploads :
2
# of downloads :
91
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
base64 certreq expand lolbin masquerade
Link:
https://www.filescan.io/uploads/6abd9f180598c8cfd3755ee8/reports/15b16847-1bf0-4d29-80a8-b33e4f70ecad/overview
Verdict:
Malicious
Labled as:
Trojan[Backdoor]/MacOS.Agent
Link:
https://www.hybrid-analysis.com/sample/3a5e7a1e5d4394d3a4fce80595dfc03301d3d6cce55094bd34a2de7b1c2c814c
Verdict:
Malicious
File Type:
macho fat
First seen:
2026-09-30T22:02:00Z UTC
Last seen:
2026-10-01T22:06:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3a5e7a1e5d4394d3a4fce80595dfc03301d3d6cce55094bd34a2de7b1c2c814c/results?tab=lookup
Score:
52%
Verdict:
Susipicious
File Type:
Mach-O universal binary
Link:
https://malprob.io/report/3a5e7a1e5d4394d3a4fce80595dfc03301d3d6cce55094bd34a2de7b1c2c814c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a5e7a1e5d4394d3a4fce80595dfc03301d3d6cce55094bd34a2de7b1c2c814c/
Threat name:
MacOS.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-30 23:45:38 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
4 of 36 (11.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjphuhs5ioknhjh45aczlx6agma5hvwm4vijjpjuulphwhbmqfga._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3a5e7a1e5d4394d3a4fce80595dfc03301d3d6cce55094bd34a2de7b1c2c814c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

php macho 3a5e7a1e5d4394d3a4fce80595dfc03301d3d6cce55094bd34a2de7b1c2c814c

(this sample)

  
Delivery method
Distributed via web download

Comments