🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6b0de2d1e40e60fe6aa94621e4bf33e567657f13b178da9744c6b04894fea86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MacSync


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6b0de2d1e40e60fe6aa94621e4bf33e567657f13b178da9744c6b04894fea86
SHA3-384 hash: 00cf6fa4a0dc7dfd1860d84a7c9ee88c5a3097eae5d955b0b665ba46f7e461af17bbb2850b87780e7d5d76b7637cf02d
SHA1 hash: c56d9a0d7ed058705a61fb1846eba16899ed8fc3
MD5 hash: 94e48ae46a579ed80b71fd4b313c583d
humanhash: batman-carpet-missouri-yellow
File name:stage1_e6b0de2d1e40.zsh
Download: download sample
Signature MacSync
Create hunting rule
File size:1'450 bytes
First seen:2026-10-15 18:28:08 UTC
Last seen:Never
File type:
MIME type:text/x-shellscript
ssdeep 24:OZto1DCwaE8bqUuV54kelz0aFN5hZdnIPbNWdQI32/GHh2tgxUF2isIT:31XPOqUunnG0y331I4K82/jyxUF2u
TLSH T11031E98C803DF72740EFC20347E8674DA8AAA9E039FEF5969346D1078780B858897251
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c4ffeine
Tags:ClickFix macOS MacSync stealer zsh


Avatar
c4ffeine
MacSync ClickFix stage-1 zsh (1,450 B) served at https://internetmissouri.com/curl/42403afd2906a8f3062e3ddb19b28572d88db9ae74b147319383bd280c6bec0a on 2026-10-15 18:24 UTC, identical for browser and curl User-Agents. base64+gzip wrapper evals a stage-2 zsh that sets domain=internetmissouri.com, curls /dynamic?txd=<token> into osascript and uploads the collected zip in chunks to /gate?buildtxd=<token>. Same /curl token as internetlouisiana.com and pevrix.com; the api-key header value matches earlier MacSync droppers.

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
US US
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6ad11deb0a39f46884900c5a/reports/7bafe6db-7a73-4b36-afcc-1fb36646f0f2/overview
Verdict:
Malicious
Labled as:
MacStealer.A.Generic
Link:
https://www.hybrid-analysis.com/sample/e6b0de2d1e40e60fe6aa94621e4bf33e567657f13b178da9744c6b04894fea86
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/e6b0de2d1e40e60fe6aa94621e4bf33e567657f13b178da9744c6b04894fea86
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e6b0de2d1e40e60fe6aa94621e4bf33e567657f13b178da9744c6b04894fea86/
Threat name:
MacOS.Trojan.MacSyncStealer
Create hunting rule
Status:
Malicious
First seen:
2026-10-15 18:40:37 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=42yn4li6idta7zvksrrb4s7thzlhmv7rhmly3klujrvqjckp5kda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DriveBy Activity
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/e6b0de2d1e40e60fe6aa94621e4bf33e567657f13b178da9744c6b04894fea86

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAC_Dropper_Shell_Base64Gzip_Heredoc
Create hunting rule
Author:Marjoriefort
Description:Dropper shell (zsh/bash) macOS : payload base64+gzip en heredoc PAYLOAD_, syntaxe BSD base64 -D, decompression inline puis eval/echo/printf
Reference:Grand Scan InTheWild.0440 / 11 misses .sh a structure identique
Rule name:Seedhook_Stage1_Zsh_B64Gzip_Eval
Create hunting rule
Description:Seedhook/MacSync ClickFix stage-1 zsh: gzip+base64 heredoc with randomised PAYLOAD_m delimiter decoded into a $d variable and eval'd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MacSync

e6b0de2d1e40e60fe6aa94621e4bf33e567657f13b178da9744c6b04894fea86

(this sample)

  
Link
https://hybrid-analysis.com/sample/e6b0de2d1e40e60fe6aa94621e4bf33e567657f13b178da9744c6b04894fea86
  
Delivery method
Distributed via web download

Comments