🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3cca282ed4a60bda2297d84eb3fc0ecb74cae57a913ebcbc409fa0ee10b2845. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3cca282ed4a60bda2297d84eb3fc0ecb74cae57a913ebcbc409fa0ee10b2845
SHA3-384 hash: 2054c3ce549434117890f6f6d66babdb72be82b28168d3882d00b13eafbe4b86fc318fe91ee61c049df17a33bb0a67b8
SHA1 hash: 6b20ed5dbc833cdc01af6f64f87f0daae3c3e732
MD5 hash: 98366774f0a855f4529b052e2b87456f
humanhash: charlie-mike-neptune-sad
File name:appd.sample
Download: download sample
File size:22'176'656 bytes
First seen:2026-11-04 10:54:22 UTC
Last seen:Never
File type:php macho
MIME type:application/x-mach-binary
ssdeep 393216:ay1a695ppsOZddVHeUvGjstc1a695ppsOZddVHeUvGjsc:awa85ppsOZddEUvGjSqa85ppsOZddEUC
TLSH T1C327AE52E38428D5D88E80F7158202EF7336E1282F738E996E199675152BC0D8D77FEE
TrID 69.8% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5)
15.0% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
15.0% (.CLASS) Java bytecode (7001/2/1)
Magika macho
Reporter timfan
Tags:CloudSyncD Mach-O machO macOS wallet


Avatar
timfan
CloudSyncD-related macOS appd stage delivered by gate task on 2026-11-03 UTC. Offline analysis found wallet ASAR patching, Ledger/Trezor recovery overlay and browser/Telegram/Notes collection code. SHA256 b3cca282ed4a60bda2297d84eb3fc0ecb74cae57a913ebcbc409fa0ee10b2845.

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aeb143e3970fcef1e4b063e
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
base64 expand lolbin
Link:
https://www.filescan.io/uploads/6aeb159636a950c80de5f6d8/reports/fe065329-01b7-43f2-ab03-15893a2948e4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b3cca282ed4a60bda2297d84eb3fc0ecb74cae57a913ebcbc409fa0ee10b2845
Verdict:
Unknown
File Type:
macho fat
Link:
https://opentip.kaspersky.com/b3cca282ed4a60bda2297d84eb3fc0ecb74cae57a913ebcbc409fa0ee10b2845/results?tab=lookup
Score:
79%
Verdict:
Malware
File Type:
Mach-O universal binary
Link:
https://malprob.io/report/b3cca282ed4a60bda2297d84eb3fc0ecb74cae57a913ebcbc409fa0ee10b2845
Gathering data
Threat name:
MacOS.Trojan.CloudSyncD
Create hunting rule
Status:
Malicious
First seen:
2026-11-04 11:18:17 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
1 of 23 (4.35%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wpgkfaxnjjql3irjpwcowp6a5s3uzlsxvej6xs6ebh5a5yilfbcq._file
Malware Family:
cloudsyncd
Create hunting rule
Malicious:
True
Tags:
arm dropper multi-arch self-signed macho 64bits
Link:
https://intel.virussign.com/intelligence/file/b3cca282ed4a60bda2297d84eb3fc0ecb74cae57a913ebcbc409fa0ee10b2845
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b3cca282ed4a60bda2297d84eb3fc0ecb74cae57a913ebcbc409fa0ee10b2845

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:JAVA_Malware_Unknown_ForgeAuto_03a7ca91
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_fffbff25
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MacOS_Trojan_CloudSyncD_afad16ad
Create hunting rule
Author:Elastic Security
Rule name:MULTI_Malware_RemcosRAT_ForgeAuto_4785f0c3
Create hunting rule
Author:Marjoriefort
Description:Detects RemcosRAT (inconnu, etat binaire)
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SCRIPT_Dropper_Formbook_ForgeAuto_10592ed2_Script
Create hunting rule
Author:Marjoriefort
Description:Detects Formbook (script_js, etat script)
Rule name:SCRIPT_Dropper_Formbook_ForgeAuto_a070f81e_Script
Create hunting rule
Author:Marjoriefort
Description:Detects Formbook (script_js, etat script)
Rule name:SUSP_HTML_XMLHTTP_Redirect_Kit
Create hunting rule
Author:Marjoriefort
Description:HTML avec exfiltration XMLHTTP + redirection window.location - kit phishing frais
Reference:Veille fraicheur 2026-09-14 / cluster HTML
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malpedia
Malpedia
https://malpedia.caad.fkie.fraunhofer.de/details/osx.cloudsyncd
  
Delivery method
Other

Comments