MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e
SHA3-384 hash:	ba15666ae174e9c49457f3bc1e18c37112873100ae348fbda7f57e6df30edfac4fda4beb82c82f8e6a78a14730d22986
SHA1 hash:	16a5e3979a0b3f4cdfc587fe85c1f1a2615c5ab9
MD5 hash:	e58d91ef40850e7aabde1ec25ad2fe59
humanhash:	sixteen-october-bacon-michigan
File name:	69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e.sh
Download:	download sample
Signature	MacSync Alert Create hunting rule
File size:	1'432 bytes
First seen:	2026-04-15 11:22:51 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:3tYHnM+dqN7gtNvAXNndhCTMNzcrQhTckRzKQGby+71PbbnCQM/SCC3v:2HVdqWbrQSkCb9RPbA/+f
TLSH	T1CE21EB1CBE2C997DBFD9DE16EA55E635821914710D2911FA8E5C3F8128D17074010259
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	JAMESWT_WT
Tags:	MacSync MacSync-Stealer sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

54

Origin country :

IT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Mac.Stealer.1128.30387.21857.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/69df763dd920e19044fc9f31/reports/ece99eba-c8ca-4f5e-90ca-97e8ca5a8d49/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-12T18:47:00Z UTC

Last seen:

2026-04-15T09:38:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Shell.Agent.da

Link:

https://opentip.kaspersky.com/69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e/results?tab=lookup

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e/

Neiki Trojan.Shell.Agent

Verdict:

Malicious

Threat:

Trojan.Shell.Agent

Link:

https://tip.neiki.dev/file/69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e

ReversingLabs TitaniumCloud MacOS.Trojan.MacSyncStealer

Threat name:

MacOS.Trojan.MacSyncStealer

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-12 23:42:14 UTC

File Type:

Text (Shell)

AV detection:

15 of 36 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nhxvtgsy2a5t74izi5mjcyuugeipvepkonh26eqxq7xjvi2nruha._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

linux

Link:

https://tria.ge/reports/260415-nkt94acx2l/

VMRay mac.c

Malware family:

mac.c

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/69ef599a58d0/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/69ef599a58d03b3ff11947589162943110fa91ea734faf121787ee9aa34d8d0e