MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MacSync


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972
SHA3-384 hash: 18b853960623f308f20ef8c77aec6471f9feeb43a4971817dd7f1d132f852a7efe16f17c2e6b567a30602c446b8c22ab
SHA1 hash: 9ea94724f7bf761cd94b719a8a221c793594552d
MD5 hash: 5db52fc2645bd69b3e8b5cdf3f3b7f82
humanhash: salami-dakota-william-ten
File name:a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972.sh
Download: download sample
Signature MacSync
Create hunting rule
File size:1'434 bytes
First seen:2026-04-15 11:22:05 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:NsHitHOUEVAM7xO/Sbzc22lMBR0SLWI9MAB+f0vWS1BijrrYL+bmdDgQY:N1O57xOMccR0SLWI7Bas8c9dvY
TLSH T1E621B9CF8A163A7978C64050DF29B739B587ABCC3622B94896CE85DCB006D7C77FA105
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter JAMESWT_WT
Tags:MacSync MacSync-Stealer sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Mac.Stealer.1128.19895.29892.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-04-04T15:57:00Z UTC
Last seen:
2026-04-04T20:43:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Shell.Agent.da
Link:
https://opentip.kaspersky.com/a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5d4f09d9-7763-4a92-ba40-4a0e50d5b9ea
Behavior Graph:
Download SVG
%3
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972/
Verdict:
Malicious
Threat:
Trojan.Shell.Agent
Link:
https://tip.neiki.dev/file/a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972
Threat name:
MacOS.Trojan.MacSyncStealer
Create hunting rule
Status:
Malicious
First seen:
2026-04-04 20:55:02 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=udft7363lrh4yd7zvutrx2jkrpwamaifagqdvaefjdnfe4rwvfza._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260415-nkt94afv8z/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a0cb3fefdb5c4fcc0ff9ad271be92a8bec06010501a03a808548da527236a972

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments