🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93e784fdb589d9363643830cb1bac90ea71d62b1bbbe0cb65ef3d3d81961a7b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MacSync


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93e784fdb589d9363643830cb1bac90ea71d62b1bbbe0cb65ef3d3d81961a7b5
SHA3-384 hash: 7e38dc0b5d159e83786a7dd79491277acbf404b56d95643742c3fc04c53b9d34d49bbf1b1b196d79171df4610a31ddd0
SHA1 hash: e44dc34a486baf14a1e6df088ddac5459db637eb
MD5 hash: 9b431583e87b2c48fb2cfe4cd51946ce
humanhash: thirteen-early-summer-social
File name:stage1_93e784fdb589.zsh
Download: download sample
Signature MacSync
Create hunting rule
File size:1'450 bytes
First seen:2026-10-29 08:25:49 UTC
Last seen:Never
File type:zsh zsh
MIME type:text/x-shellscript
ssdeep 24:0sZJOtPPiuMiXMpvLAiOrcKXCZx8cafRYqo/t8qZzqN9yybYu47Vr+JMnHc:XnuiudXCkcKCb8ca7qZg9q3QQHc
TLSH T1533119805A8380925482EC0364C78EECAF0581AF2C6AE98C88D55410EE9873B3D0E3D3
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c4ffeine
Tags:ClickFix macOS MacSync stealer zsh


Avatar
c4ffeine
MacSync ClickFix stage-1 zsh (1,450 B) served at https://genovaorobotic.com/curl/f2bf008c663b1dc9f65367156664e523bd6bd3814f18f4499b465eb431eed25c on 2026-10-29 08:24 UTC to both a browser and a curl User-Agent; fetched via Tor. Matches the MacSync stage-1 YARA rule. Not executed.

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Mac.Stealer.1128.4981.22888.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae30328b121dd519dce92e2
Tags:
infosteal
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6ae3032518c55388fd751c1e/reports/9811255f-574a-414f-bb17-1f15ceef06b8/overview
Verdict:
Malicious
Labled as:
MacStealer.A.Generic
Link:
https://www.hybrid-analysis.com/sample/93e784fdb589d9363643830cb1bac90ea71d62b1bbbe0cb65ef3d3d81961a7b5
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-29T07:08:00Z UTC
Last seen:
2026-10-30T17:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/93e784fdb589d9363643830cb1bac90ea71d62b1bbbe0cb65ef3d3d81961a7b5/results?tab=lookup
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/93e784fdb589d9363643830cb1bac90ea71d62b1bbbe0cb65ef3d3d81961a7b5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93e784fdb589d9363643830cb1bac90ea71d62b1bbbe0cb65ef3d3d81961a7b5/
Threat name:
MacOS.Trojan.MacSyncStealer
Create hunting rule
Status:
Malicious
First seen:
2026-10-29 08:26:34 UTC
File Type:
Text (Shell)
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sptyj7nvrhmtmnsdqmgldowjb2tr2yvrxo7azns66pj5qglbu62q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/93e784fdb589d9363643830cb1bac90ea71d62b1bbbe0cb65ef3d3d81961a7b5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAC_Dropper_Shell_Base64Gzip_Heredoc
Create hunting rule
Author:Marjoriefort
Description:Dropper shell (zsh/bash) macOS : payload base64+gzip en heredoc PAYLOAD_, syntaxe BSD base64 -D, decompression inline puis eval/echo/printf
Reference:Grand Scan InTheWild.0440 / 11 misses .sh a structure identique
Rule name:Seedhook_Stage1_Zsh_B64Gzip_Eval
Create hunting rule
Description:Seedhook/MacSync ClickFix stage-1 zsh: gzip+base64 heredoc with randomised PAYLOAD_m delimiter decoded into a $d variable and eval'd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MacSync

zsh zsh 93e784fdb589d9363643830cb1bac90ea71d62b1bbbe0cb65ef3d3d81961a7b5

(this sample)

  
Delivery method
Distributed via web download

Comments