MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8050a585fe1d534cafecaa56bda08ce2ef3bc26ea2b0ddad90c6b0c2be1ef3af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	8050a585fe1d534cafecaa56bda08ce2ef3bc26ea2b0ddad90c6b0c2be1ef3af
SHA3-384 hash:	65ae0183172a33191c285d6544118b813acfdc0207e2ef38cc2742d3bb5aded3f3a3c16cd25e5ba9ac8fe857258b0ea4
SHA1 hash:	c619fa0ef314de17b76fbdeee76bbd97e04f7b46
MD5 hash:	9da6a8e9d56d6ef316d51352c81236ed
humanhash:	aspen-social-bravo-table
File name:	installer.py
Download:	download sample
File size:	80'304 bytes
First seen:	2023-07-06 13:59:36 UTC
Last seen:	Never
File type:
MIME type:	text/x-script.python
ssdeep	1536:5NGZS2C+WUuj70wAXvbpwpY+w00M6llsuKvlx+4Roh0f:5NGZS2C+WUuj70wAXvbpwnw0iGuKvOe
TLSH	T18D73D8D628076D97A283C41F0186F9A3961C90479D0C643CB6BED3D9EF2A9A9C1F4CF5
Reporter	iamdeadlyz
Tags:	chainbreaker py RealstStealer

Iamdeadlyz

Fake Blockchain Games Deliver RedLine Stealer & Realst Stealer - A New macOS Infostealer Malware
https://iamdeadlyz.gitbook.io/malware-research/july-2023/fake-blockchain-games-deliver-redline-stealer-and-realst-stealer-a-new-macos-infostealer-malware

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Application.MAC.Generic.1635.16386.27128.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control lolbin masquerade

Link:

https://www.filescan.io/uploads/64a6c8e6784d6094d919e6d5/reports/0593750b-e796-43b4-8229-ed9e8a91351c/overview

Verdict:

Malicious

Labled as:

OSX/Riskware.Keychaindump

Link:

https://www.hybrid-analysis.com/sample/8050a585fe1d534cafecaa56bda08ce2ef3bc26ea2b0ddad90c6b0c2be1ef3af

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8050a585fe1d534cafecaa56bda08ce2ef3bc26ea2b0ddad90c6b0c2be1ef3af/

Threat name:

Win32.Trojan.KeychainDump

Status:

Malicious

First seen:

2023-04-03 23:20:42 UTC

File Type:

Text (Python)

AV detection:

4 of 38 (10.53%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qbiklbp6dvjuzl7mvjll3iem4lxtxqtoukyn3lmqy2ymfpq66oxq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/230706-sjfsjacd75/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8050a585fe1d534cafecaa56bda08ce2ef3bc26ea2b0ddad90c6b0c2be1ef3af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Base64_decoding Create hunting rule
Author:	iam-py-test
Description:	Detect scripts which are decoding base64 encoded data (mainly Python, may apply to other languages)