MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe0329ffb7ba73b5aebd3ece686b5cd8a0cfdcd9fbfaa7694f64c340c1a2b91b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MioLabStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 31 File information Comments

SHA256 hash:	fe0329ffb7ba73b5aebd3ece686b5cd8a0cfdcd9fbfaa7694f64c340c1a2b91b
SHA3-384 hash:	99e13c40cf19e8e32d2cde199debafffa5c06561c7f9f0c6e9ba10af2149270ded7f291309238a5d2aa6fb1587a9fabf
SHA1 hash:	fcef135e7d4c584c38d2dc30a97618c5eb57b851
MD5 hash:	66a375b5dbd8f9308900b8336b6e582f
humanhash:	timing-indigo-orange-jersey
File name:	ledger-wallet_2.133.0_trojan_components.zip
Download:	download sample
Signature	MioLabStealer Create hunting rule
File size:	52'941'768 bytes
First seen:	2026-11-13 13:41:53 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	1572864:FcPkewwkpXVbfGMaxRa6Mw96/7caRzUD2isWDl:FykriM8RN9KISALsWDl
TLSH	T163C733616D53F6C0E7112A76E51FA93F42410AE75E969AF47FDFBB0C2640903A32E843
Magika	zip
Reporter	harperjohns
Tags:	ClickFix macOS MioLab MioLabStealer TradingView zip

harperjohns

NOTE: the full 251,393,464 B bundle zip (sha256 c69c55e37a3b7325a7892d9af6ce91e2e719b32a40c6c9e07c7222f1d876e95a) was rejected by MalwareBazaar's upload limit, so this entry is a repack of only the trojan-carrying components of that bundle (Info.plist, _CodeSignature/CodeResources, ad-hoc signed MacOS/Ledger Wallet, Resources/app.asar, Resources/app-update.yml; neutral timestamps). TROJANISED Ledger Wallet (Ledger Live) 2.133.0 for macOS arm64, bundle com.ledger.live, as served by the MioLab stealer's C2 (Last-Modified 2026-04-09). Genuine Electron app re-signed ad-hoc (no Team ID; genuine is Developer ID + notarised by Ledger SAS). renderer.bundle.js (sha256 979e1ba3...dd6a) has injected React modals; app.asar sha256 b6e9f449...a44a, ElectronAsarIntegrity recomputed. At every launch: 'Action is declined - suspicious activity was detected, we logged you out; log in back using your 24-word recovery phrase', 24-box grid, no cancel, BIP39-checked, then POST {seedPhrase,userId} to https://owqkoqoqoqoqoqqoqoo[.]info/api/ledger/seed (userId from ~/.hlpr/.ownrid = MioLab affiliate id), always answers 'Invalid seed phrase' so the victim retypes. Texts in 11 languages (en de fr es pt ru tr ja ko zh th). app-update.yml feed redirected to https://miov2iaiaoubqosiqoiajwowiwjso[.]online. Seed domain and update domain are suspended (clientHold) as of 2026-11-13, the distributing C2 still serves the bundle. Check: codesign -dv shows Signature=adhoc/no TeamIdentifier. Seed exfil endpoint also used by the Trezor bundle (96b91784...). Agent: 5a2bef67.... YARA: MAL_JS_MioLab_Trojanised_LedgerLive_SeedPhrase_Modal (own rule). Chain: YouTube lure playlists for a fake trading-software crack (391 playlists, e.g. https://www.youtube.com/playlist?list=PLY7jZ5Cd4EEr8EWE-eChHVRv4_cnA9FAW ; https://www.youtube.com/playlist?list=PLbQo8q1nBk2Js2Z_qUf36wHN_oeirTMat) -> community post https://www.youtube.com/post/UgkxpTdnpIRi-_-SuwW1TRffXScjGWsxOZ4P by https://www.youtube.com/@JohnyDodep-t8w -> telegra[.]ph/macOS-05-17 ClickFix curl|bash from toolset17[.]tools -> universal Mach-O stage 2 (MioLab/Nova C++ stealer, user_id 124, https://bazaar.abuse.ch/sample/2b4f61c274bf8e4a79cf77e7b36d18d1dd265e8e894f5f2b6d8babc6323d556a/) -> the stealer's C2 #4 isosissisisossfiof[.]com serves (as of 2026-11-13) GET /api/agent/download = this agent, and GET /api/download/app-bundle?name=ledger-wallet|trezor-suite&user_id=..&arch=arm64 = trojanised wallet apps (C2s #1-#3 lewokodwqko[.]icu, shopguoerve[.]pro, dfsjfisafosdikfos[.]info gave empty/521/522). More research: https://www.youtube.com/@harperjohnsai . Static analysis only, nothing executed. -- Harper Johns

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/dde4c5e1-ab76-44f9-91d7-97de6b9b5411/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af7157d83200b505eda71d4

Tags:

n/a

Result

Verdict:

Unknown

File Type:

ZIP File

Link:

https://app.docguard.net/fe0329ffb7ba73b5aebd3ece686b5cd8a0cfdcd9fbfaa7694f64c340c1a2b91b/results/dashboard

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6af7146d0c65dfb4a3cc9792/reports/ca1e03b6-649a-4dc9-b0b5-818b5ef02fdf/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fe0329ffb7ba73b5aebd3ece686b5cd8a0cfdcd9fbfaa7694f64c340c1a2b91b

Score:

30%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

1/10

Tags:

macos

Link:

https://tria.ge/reports/261113-sm6hcsw17p/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Bolonyokte Create hunting rule
Author:	Jean-Philippe Teissier / @Jipe_
Description:	UnknownDotNet RAT - Bolonyokte

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	dependsonpythonailib Create hunting rule
Author:	Tim Brown
Description:	Hunts for dependencies on Python AI libraries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang Create hunting rule

Rule name:	html_auto_download_b64 Create hunting rule
Author:	Tdawg
Description:	html auto download

Rule name:	HUN_APT29_EnvyScout_Jul_2023_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Hunting rule for detect possible Envyscout malware used by the APT29 group by patterns already used in the past

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_EXE_CC_Regex Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing credit card regular expressions

Rule name:	JP_Lure_Content_Hunt Create hunting rule
Description:	Hunts Japanese-language lures, fake alerts, ransom notes, and suspicious scripts

Rule name:	MAC_Stealer_FakeLedgerWallet_App Create hunting rule
Author:	Marjoriefort
Description:	Faux Ledger Wallet.app (macOS) - bundle imitant le logiciel Ledger, voleur de crypto a confirmer
Reference:	misses_archive / f8d09bb7

Rule name:	mht_inside_word Create hunting rule
Author:	dPhish
Description:	Detect embedded mht files inside microsfot word.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	SUSP_html_base64 Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious base64 strings in HTML

Rule name:	SUSP_HTML_XMLHTTP_Redirect_Kit Create hunting rule
Author:	Marjoriefort
Description:	HTML avec exfiltration XMLHTTP + redirection window.location - kit phishing frais
Reference:	Veille fraicheur 2026-09-14 / cluster HTML

Rule name:	SUSP_Script_PowerShell_Hidden_Launcher Create hunting rule
Author:	Marjoriefort
Description:	Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:	Veille fraicheur 2026-09-14 / cluster misses web

Rule name:	SUSP_Websites Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects the reference of suspicious sites that might be used to download further malware

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	Warp Create hunting rule
Author:	Seth Hardy
Description:	Warp

Rule name:	WarpStrings Create hunting rule
Author:	Seth Hardy
Description:	Warp Identifying Strings

Rule name:	without_attachments Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the no presence of any attachment
Reference:	http://laboratorio.blogs.hispasec.com/

Rule name:	with_urls Create hunting rule
Author:	Antonio Sanchez <asanchez@hispasec.com>
Description:	Rule to detect the presence of an or several urls
Reference:	http://laboratorio.blogs.hispasec.com/