d95dede4387ff516f4c23351c450427d

Hash

  • MD5: d95dede4387ff516f4c23351c450427d
  • SHA1: c491d477dbe0ae04e9aed9dbe237144c03f73ec4
  • SHA256: 77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca
  • First Seen: 2026-06-23
  • Last Seen: 2026-06-23
Shortcuts: Hybrid Analysis MalwareBazaar Virustotal

Additional Information

VirusTotal
                {
    "data": {
        "id": "77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca",
        "type": "file",
        "links": {
            "self": "https://www.virustotal.com/api/v3/files/77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca"
        },
        "attributes": {
            "total_votes": {
                "harmless": 0,
                "malicious": 0
            },
            "last_analysis_stats": {
                "malicious": 8,
                "suspicious": 0,
                "undetected": 53,
                "harmless": 0,
                "timeout": 0,
                "confirmed-timeout": 0,
                "failure": 1,
                "type-unsupported": 12
            },
            "sandbox_verdicts": {
                "Zenbox macOS": {
                    "category": "harmless",
                    "malware_classification": [
                        "CLEAN"
                    ],
                    "sandbox_name": "Zenbox macOS",
                    "confidence": 99
                }
            },
            "size": 5141184,
            "macho_info": [
                {
                    "info": {
                        "sha256": "77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca"
                    },
                    "commands": [
                        {
                            "type": "LC_DYLD_INFO_ONLY"
                        },
                        {
                            "type": "LC_SYMTAB"
                        },
                        {
                            "type": "LC_DYSYMTAB"
                        },
                        {
                            "type": "LC_LOAD_DYLINKER"
                        },
                        {
                            "type": "LC_UUID"
                        },
                        {
                            "type": "LC_BUILD_VERSION"
                        },
                        {
                            "type": "LC_SOURCE_VERSION"
                        },
                        {
                            "type": "LC_MAIN"
                        },
                        {
                            "type": "LC_LOAD_DYLIB"
                        },
                        {
                            "type": "LC_FUNCTION_STARTS"
                        },
                        {
                            "type": "LC_DATA_IN_CODE"
                        },
                        {
                            "type": "LC_CODE_SIGNATURE"
                        }
                    ],
                    "segments": [
                        {
                            "name": "__PAGEZERO",
                            "fileoff": "0x0",
                            "vmsize": "0x100000000",
                            "filesize": "0x0",
                            "vmaddr": "0x0"
                        },
                        {
                            "name": "__TEXT",
                            "fileoff": "0x0",
                            "vmsize": "0x4a4000",
                            "filesize": "0x4a4000",
                            "vmaddr": "0x100000000",
                            "sections": [
                                {
                                    "type": "S_REGULAR",
                                    "flags": [
                                        "SECTION_ATTRIBUTES_USR",
                                        "SECTION_ATTRIBUTES_SYS"
                                    ],
                                    "name": "__text"
                                },
                                {
                                    "type": "S_SYMBOL_STUBS",
                                    "flags": [
                                        "SECTION_ATTRIBUTES_USR",
                                        "SECTION_ATTRIBUTES_SYS"
                                    ],
                                    "name": "__stubs"
                                },
                                {
                                    "type": "S_REGULAR",
                                    "flags": [
                                        "SECTION_ATTRIBUTES_USR",
                                        "SECTION_ATTRIBUTES_SYS"
                                    ],
                                    "name": "__stub_helper"
                                },
                                {
                                    "type": "S_REGULAR",
                                    "name": "__const"
                                },
                                {
                                    "type": "S_REGULAR",
                                    "name": "__gcc_except_tab"
                                },
                                {
                                    "type": "S_CSTRING_LITERALS",
                                    "name": "__cstring"
                                },
                                {
                                    "type": "S_REGULAR",
                                    "name": "__unwind_info"
                                },
                                {
                                    "type": "S_ZEROFILL",
                                    "flags": [
                                        "S_CSTRING_LITERALS",
                                        "S_SYMBOL_STUBS",
                                        "SECTION_ATTRIBUTES_USR"
                                    ],
                                    "name": "__eh_frame"
                                }
                            ]
                        },
                        {
                            "name": "__DATA_CONST",
                            "fileoff": "0x4a4000",
                            "vmsize": "0x2c000",
                            "filesize": "0x2c000",
                            "vmaddr": "0x1004a4000",
                            "sections": [
                                {
                                    "type": "S_CSTRING_LITERALS",
                                    "flags": [
                                        "S_8BYTE_LITERALS"
                                    ],
                                    "name": "__got"
                                },
                                {
                                    "type": "S_REGULAR",
                                    "name": "__const"
                                }
                            ]
                        },
                        {
                            "name": "__DATA",
                            "fileoff": "0x4d0000",
                            "vmsize": "0x4000",
                            "filesize": "0x4000",
                            "vmaddr": "0x1004d0000",
                            "sections": [
                                {
                                    "type": "S_ZEROFILL",
                                    "flags": [
                                        "S_CSTRING_LITERALS",
                                        "S_8BYTE_LITERALS"
                                    ],
                                    "name": "__la_symbol_ptr"
                                },
                                {
                                    "type": "S_REGULAR",
                                    "name": "__data"
                                },
                                {
                                    "type": "S_ZEROFILL",
                                    "flags": [
                                        "S_CSTRING_LITERALS",
                                        "S_LAZY_DYLIB_SYMBOL_POINTERS"
                                    ],
                                    "name": "__thread_vars"
                                },
                                {
                                    "type": "S_ZEROFILL",
                                    "flags": [
                                        "S_LAZY_DYLIB_SYMBOL_POINTERS"
                                    ],
                                    "name": "__thread_data"
                                },
                                {
                                    "type": "S_CSTRING_LITERALS",
                                    "flags": [
                                        "S_LAZY_DYLIB_SYMBOL_POINTERS"
                                    ],
                                    "name": "__thread_bss"
                                },
                                {
                                    "type": "S_ZEROFILL",
                                    "name": "__bss"
                                }
                            ]
                        },
                        {
                            "name": "__LINKEDIT",
                            "fileoff": "0x4d4000",
                            "vmsize": "0x14000",
                            "filesize": "0x132c0",
                            "vmaddr": "0x1004d4000"
                        }
                    ],
                    "headers": {
                        "cpu_subtype": "ARM64_ALL",
                        "magic": "0xfeedfacf",
                        "size_cmds": 2824,
                        "num_cmds": 26,
                        "file_type": "executable file",
                        "cpu_subtype_lib64": false,
                        "flags": [
                            "DYLDLINK",
                            "HAS_TLV_DESCRIPTORS",
                            "NOUNDEFS",
                            "PIE",
                            "TWOLEVEL"
                        ],
                        "cpu_type": "ARM64",
                        "reserved": "0x0",
                        "entrypoint": "0x1c420"
                    },
                    "platform": 1,
                    "libs": [
                        "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit",
                        "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation",
                        "/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics",
                        "/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation",
                        "/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit",
                        "/System/Library/Frameworks/Security.framework/Versions/A/Security",
                        "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration",
                        "/usr/lib/libSystem.B.dylib",
                        "/usr/lib/libiconv.2.dylib",
                        "/usr/lib/libobjc.A.dylib"
                    ]
                }
            ],
            "first_submission_date": 1759458852,
            "reputation": 0,
            "tlsh": "T1AF36B051A91CA91FEACBF1BEDE854FB1702DB0A00124C19A3827529CDC93BD5467EB73",
            "last_analysis_date": 1782257457,
            "first_seen_itw_date": 1770208238,
            "last_analysis_results": {
                "Bkav": {
                    "method": "blacklist",
                    "engine_name": "Bkav",
                    "engine_version": "8.2.40(8338)",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Lionic": {
                    "method": "blacklist",
                    "engine_name": "Lionic",
                    "engine_version": "8.16",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Elastic": {
                    "method": "blacklist",
                    "engine_name": "Elastic",
                    "engine_version": "4.0.266",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "MicroWorld-eScan": {
                    "method": "blacklist",
                    "engine_name": "MicroWorld-eScan",
                    "engine_version": "14.0.409.0",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "ClamAV": {
                    "method": "blacklist",
                    "engine_name": "ClamAV",
                    "engine_version": "1.5.2.0",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "CMC": {
                    "method": "blacklist",
                    "engine_name": "CMC",
                    "engine_version": "2.4.2022.1",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "CAT-QuickHeal": {
                    "method": "blacklist",
                    "engine_name": "CAT-QuickHeal",
                    "engine_version": "22.00",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Skyhigh": {
                    "method": "blacklist",
                    "engine_name": "Skyhigh",
                    "engine_version": "v2021.2.0+4045",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "ALYac": {
                    "method": "blacklist",
                    "engine_name": "ALYac",
                    "engine_version": "2.0.0.10",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Malwarebytes": {
                    "method": "blacklist",
                    "engine_name": "Malwarebytes",
                    "engine_version": "3.1.0.239",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Zillya": {
                    "method": "blacklist",
                    "engine_name": "Zillya",
                    "engine_version": "2.0.0.5627",
                    "engine_update": "20260622",
                    "category": "undetected",
                    "result": null
                },
                "Sangfor": {
                    "method": "blacklist",
                    "engine_name": "Sangfor",
                    "engine_version": "2.22.3.0",
                    "engine_update": "20260622",
                    "category": "undetected",
                    "result": null
                },
                "K7AntiVirus": {
                    "method": "blacklist",
                    "engine_name": "K7AntiVirus",
                    "engine_version": "14.59.59919",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "K7GW": {
                    "method": "blacklist",
                    "engine_name": "K7GW",
                    "engine_version": "14.59.59919",
                    "engine_update": "20260623",
                    "category": "malicious",
                    "result": "Trojan ( 0040f67b1 )"
                },
                "CrowdStrike": {
                    "method": "blacklist",
                    "engine_name": "CrowdStrike",
                    "engine_version": "1.0",
                    "engine_update": "20251219",
                    "category": "undetected",
                    "result": null
                },
                "Arcabit": {
                    "method": "blacklist",
                    "engine_name": "Arcabit",
                    "engine_version": "2025.0.0.23",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "VirIT": {
                    "method": "blacklist",
                    "engine_name": "VirIT",
                    "engine_version": "9.5.1234",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Symantec": {
                    "method": "blacklist",
                    "engine_name": "Symantec",
                    "engine_version": "1.22.0.0",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "ESET-NOD32": {
                    "method": "blacklist",
                    "engine_name": "ESET-NOD32",
                    "engine_version": "18.2.18.0",
                    "engine_update": "20260623",
                    "category": "malicious",
                    "result": "OSX/Getshell.AG trojan"
                },
                "TrendMicro-HouseCall": {
                    "method": "blacklist",
                    "engine_name": "TrendMicro-HouseCall",
                    "engine_version": "24.550.0.1002",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Avast": {
                    "method": "blacklist",
                    "engine_name": "Avast",
                    "engine_version": "23.9.8494.0",
                    "engine_update": "20260623",
                    "category": "malicious",
                    "result": "MacOS:Agent-BLZ [Drp]"
                },
                "Cynet": {
                    "method": "blacklist",
                    "engine_name": "Cynet",
                    "engine_version": "4.0.3.4",
                    "engine_update": "20260623",
                    "category": "malicious",
                    "result": "Malicious (score: 99)"
                },
                "Kaspersky": {
                    "method": "blacklist",
                    "engine_name": "Kaspersky",
                    "engine_version": "22.0.1.28",
                    "engine_update": "20260623",
                    "category": "malicious",
                    "result": "HEUR:Backdoor.OSX.Agent.bj"
                },
                "BitDefender": {
                    "method": "blacklist",
                    "engine_name": "BitDefender",
                    "engine_version": "7.2",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "NANO-Antivirus": {
                    "method": "blacklist",
                    "engine_name": "NANO-Antivirus",
                    "engine_version": "1.0.170.26895",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "SUPERAntiSpyware": {
                    "method": "blacklist",
                    "engine_name": "SUPERAntiSpyware",
                    "engine_version": "5.6.0.1032",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Tencent": {
                    "method": "blacklist",
                    "engine_name": "Tencent",
                    "engine_version": "1.0.0.1",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Sophos": {
                    "method": "blacklist",
                    "engine_name": "Sophos",
                    "engine_version": "3.5.1.0",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "F-Secure": {
                    "method": "blacklist",
                    "engine_name": "F-Secure",
                    "engine_version": "18.10.1547.307",
                    "engine_update": "20260623",
                    "category": "malicious",
                    "result": "Dropper.DR/OSX.Agent.BLZ"
                },
                "DrWeb": {
                    "method": "blacklist",
                    "engine_name": "DrWeb",
                    "engine_version": "7.0.75.2070",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "VIPRE": {
                    "method": "blacklist",
                    "engine_name": "VIPRE",
                    "engine_version": "6.0.0.35",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "TrendMicro": {
                    "method": "blacklist",
                    "engine_name": "TrendMicro",
                    "engine_version": "24.550.0.1002",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "McAfeeD": {
                    "method": "blacklist",
                    "engine_name": "McAfeeD",
                    "engine_version": "1.2.0.15146",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "CTX": {
                    "method": "blacklist",
                    "engine_name": "CTX",
                    "engine_version": "2024.8.29.1",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Emsisoft": {
                    "method": "blacklist",
                    "engine_name": "Emsisoft",
                    "engine_version": "2024.8.0.61147",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "SentinelOne": {
                    "method": "blacklist",
                    "engine_name": "SentinelOne",
                    "engine_version": "7.7.0.1",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Jiangmin": {
                    "method": "blacklist",
                    "engine_name": "Jiangmin",
                    "engine_version": "16.0.100",
                    "engine_update": "20260622",
                    "category": "undetected",
                    "result": null
                },
                "Google": {
                    "method": "blacklist",
                    "engine_name": "Google",
                    "engine_version": "1782252055",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Avira": {
                    "method": "blacklist",
                    "engine_name": "Avira",
                    "engine_version": "8.3.3.24",
                    "engine_update": "20260623",
                    "category": "malicious",
                    "result": "DR/OSX.Agent.BLZ"
                },
                "Antiy-AVL": {
                    "method": "blacklist",
                    "engine_name": "Antiy-AVL",
                    "engine_version": "3.0",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Kingsoft": {
                    "method": "blacklist",
                    "engine_name": "Kingsoft",
                    "engine_version": "None",
                    "engine_update": "20260618",
                    "category": "undetected",
                    "result": null
                },
                "Xcitium": {
                    "method": "blacklist",
                    "engine_name": "Xcitium",
                    "engine_version": "38752",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Microsoft": {
                    "method": "blacklist",
                    "engine_name": "Microsoft",
                    "engine_version": "1.1.26050.11",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "ViRobot": {
                    "method": "blacklist",
                    "engine_name": "ViRobot",
                    "engine_version": "2014.3.20.0",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "ZoneAlarm": {
                    "method": "blacklist",
                    "engine_name": "ZoneAlarm",
                    "engine_version": "6.25-116107742",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "GData": {
                    "method": "blacklist",
                    "engine_name": "GData",
                    "engine_version": "GD:27.45018AVA:64.31466",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Varist": {
                    "method": "blacklist",
                    "engine_name": "Varist",
                    "engine_version": "6.6.1.3",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "AhnLab-V3": {
                    "method": "blacklist",
                    "engine_name": "AhnLab-V3",
                    "engine_version": "3.30.1.10706",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Acronis": {
                    "method": "blacklist",
                    "engine_name": "Acronis",
                    "engine_version": "1.2.0.121",
                    "engine_update": "20240328",
                    "category": "undetected",
                    "result": null
                },
                "VBA32": {
                    "method": "blacklist",
                    "engine_name": "VBA32",
                    "engine_version": "5.6.1",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "TACHYON": {
                    "method": "blacklist",
                    "engine_name": "TACHYON",
                    "engine_version": "2026-06-23.02",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Zoner": {
                    "method": "blacklist",
                    "engine_name": "Zoner",
                    "engine_version": "2.2.2.0",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Rising": {
                    "method": "blacklist",
                    "engine_name": "Rising",
                    "engine_version": "25.0.0.28",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Yandex": {
                    "method": "blacklist",
                    "engine_name": "Yandex",
                    "engine_version": "5.5.2.24",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "TrellixENS": {
                    "method": "blacklist",
                    "engine_name": "TrellixENS",
                    "engine_version": "6.0.6.653",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "huorong": {
                    "method": "blacklist",
                    "engine_name": "huorong",
                    "engine_version": "b0b50d7:b0b50d7:f492ab7:f492ab7",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "MaxSecure": {
                    "method": "blacklist",
                    "engine_name": "MaxSecure",
                    "engine_version": "1.0.0.1",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "Fortinet": {
                    "method": "blacklist",
                    "engine_name": "Fortinet",
                    "engine_version": "7.0.48.0",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "AVG": {
                    "method": "blacklist",
                    "engine_name": "AVG",
                    "engine_version": "23.9.8494.0",
                    "engine_update": "20260623",
                    "category": "malicious",
                    "result": "MacOS:Agent-BLZ [Drp]"
                },
                "Panda": {
                    "method": "blacklist",
                    "engine_name": "Panda",
                    "engine_version": "4.6.4.2",
                    "engine_update": "20260623",
                    "category": "undetected",
                    "result": null
                },
                "alibabacloud": {
                    "method": "blacklist",
                    "engine_name": "alibabacloud",
                    "engine_version": "2.2.0",
                    "engine_update": "20250321",
                    "category": "undetected",
                    "result": null
                },
                "Ikarus": {
                    "method": "blacklist",
                    "engine_name": "Ikarus",
                    "engine_version": "6.5.4.0",
                    "engine_update": "20260623",
                    "category": "failure",
                    "result": null
                },
                "Avast-Mobile": {
                    "method": "blacklist",
                    "engine_name": "Avast-Mobile",
                    "engine_version": "260623-06",
                    "engine_update": "20260623",
                    "category": "type-unsupported",
                    "result": null
                },
                "SymantecMobileInsight": {
                    "method": "blacklist",
                    "engine_name": "SymantecMobileInsight",
                    "engine_version": "2.0",
                    "engine_update": "20260123",
                    "category": "type-unsupported",
                    "result": null
                },
                "BitDefenderFalx": {
                    "method": "blacklist",
                    "engine_name": "BitDefenderFalx",
                    "engine_version": "2.0.936",
                    "engine_update": "20260525",
                    "category": "type-unsupported",
                    "result": null
                },
                "tehtris": {
                    "method": "blacklist",
                    "engine_name": "tehtris",
                    "engine_version": "v0.1.4",
                    "engine_update": "20260623",
                    "category": "type-unsupported",
                    "result": null
                },
                "DeepInstinct": {
                    "method": "blacklist",
                    "engine_name": "DeepInstinct",
                    "engine_version": "5.0.0.8",
                    "engine_update": "20260614",
                    "category": "type-unsupported",
                    "result": null
                },
                "Webroot": {
                    "method": "blacklist",
                    "engine_name": "Webroot",
                    "engine_version": "1.9.0.8",
                    "engine_update": "20250227",
                    "category": "type-unsupported",
                    "result": null
                },
                "APEX": {
                    "method": "blacklist",
                    "engine_name": "APEX",
                    "engine_version": "6.791",
                    "engine_update": "20260622",
                    "category": "type-unsupported",
                    "result": null
                },
                "Paloalto": {
                    "method": "blacklist",
                    "engine_name": "Paloalto",
                    "engine_version": "0.9.0.1003",
                    "engine_update": "20260623",
                    "category": "type-unsupported",
                    "result": null
                },
                "Alibaba": {
                    "method": "blacklist",
                    "engine_name": "Alibaba",
                    "engine_version": "0.3.0.5",
                    "engine_update": "20190527",
                    "category": "type-unsupported",
                    "result": null
                },
                "Trapmine": {
                    "method": "blacklist",
                    "engine_name": "Trapmine",
                    "engine_version": "4.0.12.0",
                    "engine_update": "20260604",
                    "category": "type-unsupported",
                    "result": null
                },
                "Cylance": {
                    "method": "blacklist",
                    "engine_name": "Cylance",
                    "engine_version": "3.0.0.0",
                    "engine_update": "20260618",
                    "category": "type-unsupported",
                    "result": null
                },
                "Trustlook": {
                    "method": "blacklist",
                    "engine_name": "Trustlook",
                    "engine_version": "1.0",
                    "engine_update": "20260623",
                    "category": "type-unsupported",
                    "result": null
                }
            },
            "crowdsourced_ids_results": [
                {
                    "rule_category": "protocol-command-decode",
                    "alert_severity": "low",
                    "rule_msg": "(stream_tcp) data sent on stream after TCP reset sent",
                    "rule_id": "129:8",
                    "rule_source": "Snort registered user ruleset",
                    "rule_url": "https://www.snort.org/downloads/#rule-downloads",
                    "rule_raw": "alert ( gid:129; sid:8; rev:2; msg:\"(stream_tcp) data sent on stream after TCP reset sent\"; metadata: policy max-detect-ips drop, rule-type preproc; classtype:protocol-command-decode;)",
                    "alert_context": [
                        {
                            "dest_ip": "104.76.210.25",
                            "dest_port": 443
                        }
                    ]
                },
                {
                    "rule_category": "Generic Protocol Command Decode",
                    "alert_severity": "low",
                    "rule_msg": "SURICATA STREAM excessive retransmissions",
                    "rule_id": "1:2210054",
                    "rule_source": "Suricata",
                    "rule_url": "https://www.openinfosecfoundation.org/",
                    "rule_raw": "alert tcp any any -> any any (msg:\"SURICATA STREAM excessive retransmissions\"; flowbits:isnotset,tcp.retransmission.alerted; flowint:tcp.retransmission.count,>=,10; flowbits:set,tcp.retransmission.alerted; classtype:protocol-command-decode; sid:2210054; rev:1;)",
                    "alert_context": [
                        {
                            "src_ip": "17.253.7.132",
                            "src_port": 443
                        }
                    ]
                }
            ],
            "times_submitted": 4,
            "type_tag": "macho",
            "trid": [
                {
                    "file_type": "Mac OS X Mach-O 64-bit ARM executable",
                    "probability": 100.0
                }
            ],
            "filecondis": {
                "dhash": "00383c3e1e0e3100",
                "raw_md5": "4f4b0af38d8c731635df96b43337eb6a"
            },
            "md5": "d95dede4387ff516f4c23351c450427d",
            "signature_info": {
                "Identifier": "agent-ae630ed3b85da715",
                "TeamIdentifier": "not set",
                "Format": "Mach-O thin (arm64)",
                "CDHash": "7954f01ab3d9ccb8ce2f90e13d86a94e7a622a7e",
                "Hash choices": "sha256",
                "CandidateCDHash sha256": "7954f01ab3d9ccb8ce2f90e13d86a94e7a622a7e",
                "CandidateCDHashFull sha256": "7954f01ab3d9ccb8ce2f90e13d86a94e7a622a7e0c054ad689f7efb9667c81d7",
                "Info.plist": "not bound",
                "CMSDigest": "7954f01ab3d9ccb8ce2f90e13d86a94e7a622a7e0c054ad689f7efb9667c81d7",
                "CMSDigestType": "2"
            },
            "ssdeep": "49152:dAbbTiLvTB7tKg8EPTwyJ8qRuErRXviYGemL7QNpxAMxdlOqIU6iGkb/E7SXpxr:WbTqBsg8EPTw68UNrRW4N4x9+i7SXpxr",
            "tags": [
                "macho",
                "signed",
                "self-signed",
                "64bits",
                "arm"
            ],
            "meaningful_name": "agent-ae630ed3b85da715",
            "vhash": "549a75fdd1aeab18215cc6a56e6e35e5",
            "crowdsourced_ids_stats": {
                "high": 0,
                "medium": 0,
                "low": 2,
                "info": 0
            },
            "detectiteasy": {
                "filetype": "Mach-O64",
                "values": [
                    {
                        "info": "EXECUTE64",
                        "type": "Operation system",
                        "name": "macOS"
                    }
                ]
            },
            "popular_threat_classification": {
                "suggested_threat_label": "trojan.getshell",
                "popular_threat_name": [
                    {
                        "count": 1,
                        "value": "getshell"
                    }
                ],
                "popular_threat_category": [
                    {
                        "count": 3,
                        "value": "trojan"
                    },
                    {
                        "count": 1,
                        "value": "dropper"
                    }
                ]
            },
            "type_description": "Mach-O",
            "sha256": "77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca",
            "last_modification_date": 1782264687,
            "last_submission_date": 1759474647,
            "symhash": "a2ab17e97497e58727985ebd62f2ba13",
            "magic": "Mach-O 64-bit arm64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|PIE|HAS_TLV_DESCRIPTORS>",
            "magika": "MACHO",
            "unique_sources": 3,
            "type_tags": [
                "executable",
                "mac",
                "macho"
            ],
            "names": [
                "11013",
                "Update",
                "Update_file_to_Scan.sh",
                "theupdate.sh"
            ],
            "sha1": "c491d477dbe0ae04e9aed9dbe237144c03f73ec4"
        }
    }
}
            

Related Reports

« Back
⚠ These IoCs were automatically extracted using regular expressions or an LLM and may include non-malicious data.