Open-source atomic malware analysis

Analyze another

AppleApp.xz

XZ
Verdict: HOSTILE
SHA256: 356f1b96b78da0a7d08f9c4e0d3413cfc0510fcf1c87cc2fec754bf808805ad9
Mal-ecule
KO₇(As₂P₂SC₂AlDyLa)H₄(Cm₇DbF₂Po₃)Md₃(HeSiBi)
Size 23.3 KB download
First seen 118 days ago
Analyzed 106 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 70% confident.
anti-static/obfuscation/payload Very few imports (<=50) with system()
suspicious severity, 75% confident.
persistence/system/daemon Unix daemon persistence mechanism
notable severity, 100% confident.
command-and-control/infrastructure IPv4 address with port number string

Micro-behaviors

notable severity, 92% confident.
communications/benchmark Large Speedtest upload probe
notable severity, 78% confident.
communications/http HTTP POST request line
notable severity, 66% confident.
communications/ip Parse IP with inet_addr
notable severity, 66% confident.
communications/socket Uses connect socket call
notable severity, 90% confident.
data/text Shell executes /tmp payload directly
notable severity, 70% confident.
fs/chmod Shell chmod 7xx (executable)
notable severity, 80% confident.
fs/file Read file status and metadata (core)
notable severity, 95% confident.
process/create Executes command and captures output
notable severity, 90% confident.
process/create/shell system() function call
baseline severity, 90% confident.
os/signal Install signal handler

Metadata

notable severity, 85% confident.
hardening FORTIFY_SOURCE strcpy bounds check
notable severity, 100% confident.
signed Ad-hoc Signature
baseline severity, 100% confident.
arch ARM64 Mach-O binary
baseline severity, 100% confident.
binary Mach-O linked dylib
baseline severity, 100% confident.
binary/linking Mach-O linked dylib metadata
baseline severity, 100% confident.
binary/metrics Binary has low average complexity
baseline severity, 95% confident.
dylib::usr/lib/libsystem/b links /usr/lib/libSystem.B.dylib (chkstk_darwin, stack_chk_guard, dyld_stub_binder, memcpy_chk, stack_chk_fail, ... +39 more)

20 of 33 traits shown

Identity

SHA-256 356f1b96b78da0a7d08f9c4e0d3413cfc0510fcf1c87cc2fec754bf808805ad9
Filename AppleApp.xz

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 6 May 2026 11:15 UTC
Last updated 18 May 2026 09:35 UTC

Labeling

Label bad
Label source harvest
Traits version 84923