MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96b9178496ed37d63e34b7df925f79fd6a7acb4e78bf551acd978b0cb8c7097c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MioLabStealer

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	96b9178496ed37d63e34b7df925f79fd6a7acb4e78bf551acd978b0cb8c7097c
SHA3-384 hash:	28080be1da1d0c2527164324493fbd599df6c66909b601ea38be446d570d69dd17b21987fd65511c3d49012a9208bd6b
SHA1 hash:	f815a3bf5041e53d96d1c2a71ff32a3676f326b7
MD5 hash:	712c43c1787385d2c1d6c1a2ecf0b2c5
humanhash:	chicken-comet-butter-sweet
File name:	trezor-suite_arm64_TrezorSuite-dev-26.3.3_trojan.zip
Download:	download sample
Signature	MioLabStealer Create hunting rule
File size:	150'487'132 bytes
First seen:	2026-11-13 13:40:27 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	3145728:IF1fB6MyYIn7ZOcD2PbM0M8ar/dNfo/2FmDeLM86B1Y:JYInAcDobMHNFNfo0X6BC
TLSH	T15278331CD3FC1B63FA7691F7F8C46C03B997A10EF451E1969A520208E5F32D19858AAF
TrID	84.3% (.PBIVIZ) Power BI desktop Visual data (21500/1/4) 15.6% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	harperjohns
Tags:	ClickFix macOS MioLab MioLabStealer TradingView zip

harperjohns

TROJANISED Trezor Suite for macOS arm64: a Trezor Suite 26.3.3 DEVELOPMENT build (io.trezor.TrezorSuite.dev, @trezor/suite-desktop-dev; genuine release id is io.trezor.TrezorSuite) rebuilt from source by the operator, as served by the MioLab stealer's C2 (zip 150,487,132 B, Last-Modified 2026-04-15). All binaries ad-hoc signed, no Team ID. Renderer build/main.8354a95b.js (sha256 1bea6a55...8256) mounts a modal 'Action is declined - suspicious activity... log in back using your recovery phrase', then a 12/20/24-word form (BIP39 / SLIP39 check, autocomplete) falsely claiming 'input stays on this computer only', and POSTs {seedPhrase,userId} to https://owqkoqoqoqoqoqqoqoo[.]info/api/trezor/seed (userId via new IPC user-data/get-id reading ~/.hlpr/.ownrid); then always shows 'not a valid recovery phrase'. dist/app.js and dist/preload.js patched for the IPC. app.asar sha256 05ca2570...802b. Seed domain suspended as of 2026-11-13; the distributing C2 still serves the bundle. Check: codesign -dv shows Signature=adhoc/no TeamIdentifier, bundle id ends .dev. Sister sample: trojanised Ledger Wallet c69c55e3.... Agent: 5a2bef67.... YARA: MAL_JS_MioLab_Trojanised_TrezorSuite_SeedPhrase_Modal (own rule). Chain: YouTube lure playlists for a fake trading-software crack (391 playlists, e.g. https://www.youtube.com/playlist?list=PLY7jZ5Cd4EEr8EWE-eChHVRv4_cnA9FAW ; https://www.youtube.com/playlist?list=PLbQo8q1nBk2Js2Z_qUf36wHN_oeirTMat) -> community post https://www.youtube.com/post/UgkxpTdnpIRi-_-SuwW1TRffXScjGWsxOZ4P by https://www.youtube.com/@JohnyDodep-t8w -> telegra[.]ph/macOS-05-17 ClickFix curl|bash from toolset17[.]tools -> universal Mach-O stage 2 (MioLab/Nova C++ stealer, user_id 124, https://bazaar.abuse.ch/sample/2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a/) -> the stealer's C2 #4 isosissisisossfiof[.]com serves (as of 2026-11-13) GET /api/agent/download = this agent, and GET /api/download/app-bundle?name=ledger-wallet|trezor-suite&user_id=..&arch=arm64 = trojanised wallet apps (C2s #1-#3 lewokodwqko[.]icu, shopguoerve[.]pro, dfsjfisafosdikfos[.]info gave empty/521/522). More research: https://www.youtube.com/@harperjohnsai . Static analysis only, nothing executed. -- Harper Johns