MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb07743d139f72fca4616b01308f1f705f02fda72988027bc68e9316655eadda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 3 File information Comments

SHA256 hash:	fb07743d139f72fca4616b01308f1f705f02fda72988027bc68e9316655eadda
SHA3-384 hash:	7e853875623e5ebf1550cce0dd22501447e92afc1c97f09c08760712affea59e0762b13fc67b7347cd3d2c8f64fa33c8
SHA1 hash:	29e5b7ea24ef3e21ba229f7ef0403f58736765a1
MD5 hash:	e0231f06123657f0f0b54af47208a304
humanhash:	quiet-magazine-three-maine
File name:	darwin.node
Download:	download sample
File size:	1'603'472 bytes
First seen:	2025-11-28 13:13:40 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	24576:q0HeFRd6AdlDTsLZtUU6XLxOIjvjYApjdMdxQvGrfstMIdjvo8JHcpx5:deFRd6AdlD7s2M72ds8J8px5
TLSH	T19E759F53A91C59ABEECBB1BCCC854EB5713EF2A0032581DA341756ACE4C3BD1452E7B2
Magika	macho
Reporter	marius_benthin
Tags:	implant machO Rust vscode

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6929a0276657e3433281d486

Tags:

n/a

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

base64 masquerade

Link:

https://www.filescan.io/uploads/6929a023d0d5e7288b4f5a0f/reports/46c8e423-d161-4f5d-a145-b78ed15727c8/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fb07743d139f72fca4616b01308f1f705f02fda72988027bc68e9316655eadda

Verdict:

Clean

File Type:

macho x64 le

Link:

https://opentip.kaspersky.com/fb07743d139f72fca4616b01308f1f705f02fda72988027bc68e9316655eadda/results?tab=lookup

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb07743d139f72fca4616b01308f1f705f02fda72988027bc68e9316655eadda/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/fb07743d139f72fca4616b01308f1f705f02fda72988027bc68e9316655eadda

Threat name:

MacOS.Trojan.Generic

Status:

Suspicious

First seen:

2025-11-28 10:36:05 UTC

File Type:

MachO64 Little (SO)

AV detection:

3 of 38 (7.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7mdxipitt5zpzjdbnmatbdy7obpqf7nhfgeae66gr2jrmzk6vxna._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	ldpreload Create hunting rule
Author:	xorseed
Reference:	https://stuff.rop.io/

Rule name:	Rustyloader_mem_loose Create hunting rule
Author:	James_inthe_box
Description:	Corroded buerloader
Reference:	https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24