🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69
SHA3-384 hash: ab6406a9c801fd4d3d9ff53cbfd45f9ff20a48730b7603b637dba1325939c077afe96658805fbab9a1a4008220f30824
SHA1 hash: d80a28da13a0cf303b82eed0bb9cdac63e769344
MD5 hash: f14cda33d087e6929b719e30d4c4be5b
humanhash: triple-stream-carbon-timing
File name:payload.py
Download: download sample
File size:11'549 bytes
First seen:2026-10-12 12:35:53 UTC
Last seen:Never
File type:py py
MIME type:text/x-script.python
ssdeep 192:CQsTmrkeUUCZG9jnrNgn0LZ/OvbJyRF6VOTbvUmDZm:CQJ6ZW3wvF/O/U/
TLSH T106329296893D1415D2C3F768696281C51A0ABDF74A03583872EC9BD4CF0B8F9D379A2E
TrID 70.0% (.) Unix-like shebang (var.1) (gen) (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika python
Reporter SOCRadarSTRU
Tags:ICMacOS py STRU


Avatar
SOCRadarSTRU
🚨 Inside ICMacOS: From an Infostealer to a Persistent RAT | SOCRadar STRU IOC

SOCRadar Threat Research Unit (STRU) identified ICMacOS (Icarus macOS), a newly marketed macOS MaaS stealer actively promoted across underground forums by the actor GlowComa. The infection chain relies on initial dropper scripts to detect the host architecture and harvest administrator passwords using fake system dialogs before delivering the primary payload. Version 1 focuses on stealing core assets, including browser credentials, password manager databases, cryptocurrency wallets, developer secrets, messaging application data, and local files. Version 2 expands these credential-harvesting capabilities while introducing full RAT functionality, leveraging WebSockets for Command-and-Control (C2) and LaunchAgents for persistence.


📚 Source: https://socradar.io/blog/icmacos-infostealer-rat/

🔍 IOC Reference:
Full IOC list available on the SOCRadar platform: https://platform.socradar.com/

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Generic.PY.Stealer.1.025128A2.21185482.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad0faebf4e17c78f715d527
Tags:
virus
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6accd47ad1c57be26391e3d0/reports/f99b9bfa-8ee7-44cd-8120-0d0c8c8ecef9/overview
Verdict:
Malicious
Labled as:
PY.Stealer.1.Generic
Link:
https://www.hybrid-analysis.com/sample/8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-09T23:01:00Z UTC
Last seen:
2026-10-14T09:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69/results?tab=lookup
Score:
67%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69/
Threat name:
Script-Python.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-09-10 02:22:32 UTC
File Type:
Text (Python)
AV detection:
12 of 23 (52.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rnbqhidf4ghiabio6iqdd3dawgsoqt4vrwpfntc4yngnfhmyrvuq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution linux
Link:
https://tria.ge/reports/261012-ptk88a1t5p/
Behaviour
Command and Scripting Interpreter: Python
Writes file to tmp directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DriveBy Activity
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments