MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc438c6e231c80c0d5de5b5a194fdba87f88e334414b248047c5e412ed613a6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fc438c6e231c80c0d5de5b5a194fdba87f88e334414b248047c5e412ed613a6a
SHA3-384 hash:	42e643b296abb621c5fa8e8f0cb39732a30b03cf04113ad6c9e30f7041d498fcfeb2626b5aee5bc6d39abf7397e2ce72
SHA1 hash:	856f38950d36ad9b00bb1a581a47babff0d6e79b
MD5 hash:	4f82e622161a1d3c94fd15474a664309
humanhash:	carpet-dakota-missouri-oscar
File name:	Destruction.pkg
Download:	download sample
File size:	3'020'370 bytes
First seen:	2023-07-06 14:06:53 UTC
Last seen:	Never
File type:	unknown
MIME type:	application/x-xar
ssdeep	49152:jtpilTB6UK/Orcw1huP6iWQQQFVbI2MNmfgr2Pe1N+Z2T5NP3q5TqWNJaqQcoVRh:jtpUdBcw1huPLWQQQFVbMkgV1AQXGpxe
TLSH	T122E533C43890778C31DCB948AFA2308DC3215F985A839892B4169CEDC59E5AFEDE5DDC
Reporter	iamdeadlyz
Tags:	macOS pkg RealstStealer

Iamdeadlyz

Fake Blockchain Games Deliver RedLine Stealer & Realst Stealer - A New macOS Infostealer Malware
https://iamdeadlyz.gitbook.io/malware-research/july-2023/fake-blockchain-games-deliver-redline-stealer-and-realst-stealer-a-new-macos-infostealer-malware

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

119

Origin country :

SG

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.MAC.Generic.112644.16363.3776.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Application.MAC.Generic.1635.16386.27128.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Variant.Trojan.MAC.Stealer.5.21721.30988.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Trojan.MAC.Generic.112644.17024.12871.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/64a6ca898fe1b04d4185331d/reports/daa57a58-e926-4ad6-bc34-1cd4494be2da/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fc438c6e231c80c0d5de5b5a194fdba87f88e334414b248047c5e412ed613a6a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc438c6e231c80c0d5de5b5a194fdba87f88e334414b248047c5e412ed613a6a/

ReversingLabs TitaniumCloud MacOS.Trojan.KeychainDump

Threat name:

MacOS.Trojan.KeychainDump

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-06 14:07:07 UTC

File Type:

Binary (Archive)

Extracted files:

17

AV detection:

3 of 38 (7.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7rbyy3rddsambvo6lnnbst63vb7yryzuiffsjachyxsbf3lbhjva._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fc438c6e231c80c0d5de5b5a194fdba87f88e334414b248047c5e412ed613a6a