🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd86aee4882b93ccd3e993b9d8f12bd372640ed765893fcab27c5919d2f154d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MacSync


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cd86aee4882b93ccd3e993b9d8f12bd372640ed765893fcab27c5919d2f154d1
SHA3-384 hash: 405b0f6980e5dba230cac27a92b213ec194dcaf9a92faaa0384a9f74d58d4c05975ce89b7e8189e972f3d99a4d628137
SHA1 hash: b577b548bbfaf20704bafc3b5dc5a58e51d00080
MD5 hash: fdaa1b1c83bc7fd18cf6f4a1eb855280
humanhash: yellow-september-summer-cola
File name:stage1_cd86aee4882b.zsh
Download: download sample
Signature MacSync
Create hunting rule
File size:1'442 bytes
First seen:2026-11-06 18:24:31 UTC
Last seen:Never
File type:zsh zsh
MIME type:text/x-shellscript
ssdeep 24:xitK3ppKTmfnYmatIJo9IG15SC+m+lF9HyNq7W2BgRZyc9N/CHBMTtW3D+:n3pETmfYhOoizrdqqLgRQc70BMM3K
TLSH T10321E61B90BE067291CD114C05309A86AA1236039B121A71FC400BF1E172CAF25ABCA4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c4ffeine
Tags:ClickFix macOS MacSync stealer zsh


Avatar
c4ffeine
MacSync ClickFix stage-1 zsh (1,442 B) served at https://seohumanoid.com/curl/42403afd2906a8f3062e3ddb19b28572d88db9ae74b147319383bd280c6bec0a on 2026-11-06 18:22 UTC to both a browser and a curl User-Agent; fetched via Tor. Matches the MacSync stage-1 YARA rule; same path token as the earlier MacSync host pevrix.com. Not executed.

Intelligence

File Origin
# of uploads :
1
# of downloads :
120
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1ba3bac89c90fc65a4c3bmacos16vpnfull_triage
Tags:
virus agent sage
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6aee1bc3d4b4ae66a0655aee/reports/c0ff7df2-1f6a-4ac1-a36a-ac01db9f91f5/overview
Verdict:
Malicious
Labled as:
MacStealer.A.Generic
Link:
https://www.hybrid-analysis.com/sample/cd86aee4882b93ccd3e993b9d8f12bd372640ed765893fcab27c5919d2f154d1
Verdict:
Malicious
File Type:
unix shell
Link:
https://opentip.kaspersky.com/cd86aee4882b93ccd3e993b9d8f12bd372640ed765893fcab27c5919d2f154d1/results?tab=lookup
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cd86aee4882b93ccd3e993b9d8f12bd372640ed765893fcab27c5919d2f154d1/
Threat name:
MacOS.Trojan.MacSyncStealer
Create hunting rule
Status:
Malicious
First seen:
2026-11-06 18:25:19 UTC
File Type:
Text (Shell)
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zwdk5zeifoj4zu7jso45r4jl2nzgidwxmwet7svsprmrtuxrktiq._file
Malware Family:
macstealer
Create hunting rule
Malicious:
True
Tags:
malware self-delete shell
Link:
https://intel.virussign.com/intelligence/file/cd86aee4882b93ccd3e993b9d8f12bd372640ed765893fcab27c5919d2f154d1
Malware family:
mac.c
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cd86aee4882b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cd86aee4882b93ccd3e993b9d8f12bd372640ed765893fcab27c5919d2f154d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAC_Dropper_Shell_Base64Gzip_Heredoc
Create hunting rule
Author:Marjoriefort
Description:Dropper shell (zsh/bash) macOS : payload base64+gzip en heredoc PAYLOAD_, syntaxe BSD base64 -D, decompression inline puis eval/echo/printf
Reference:Grand Scan InTheWild.0440 / 11 misses .sh a structure identique
Rule name:Seedhook_Stage1_Zsh_B64Gzip_Eval
Create hunting rule
Description:Seedhook/MacSync ClickFix stage-1 zsh: gzip+base64 heredoc with randomised PAYLOAD_m delimiter decoded into a $d variable and eval'd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MacSync

zsh zsh cd86aee4882b93ccd3e993b9d8f12bd372640ed765893fcab27c5919d2f154d1

(this sample)

  
Delivery method
Distributed via web download

Comments