Open-source atomic malware analysis

Analyze another

setup

MACHO
Verdict: SUSPICIOUS
SHA256: 6427baa1ce5ba37ff6cf3fff79b543018a0a8e8f088c3f66afb24561e4e9de43
Mal-ecule
KO₄(Er₃AlAs₂P)H₂(Po₃Db)Md(Si)
Size 325.0 KB download
First seen 117 days ago
Analyzed 115 days ago
Ecosystem malcontent-samples

Well-known

component severity, 100% confident.
malware/stealer main function export

Objectives

hostile severity, 95% confident.
evasion/masquerade Silent background daemon with masqueraded identity
notable severity, 80% confident.
anti-analysis Extremely low logic density (function sparsity)
component severity, 90% confident.
anti-static/obfuscation Hex-prefixed JS variables in non-code file
component severity, 90% confident.
anti-static/pack Binary has many functions
component severity, 75% confident.
persistence/system/daemon Unix daemon persistence mechanism

Micro-behaviors

notable severity, 90% confident.
process/create system() function call
notable severity, 80% confident.
process/terminate pkill command
baseline severity, 90% confident.
dylib/library GNU libstdc++ stdlib
baseline severity, 90% confident.
os/signal Install signal handler
baseline severity, 66% confident.
process/fork Process forking

Metadata

notable severity, 100% confident.
signed Ad-hoc Signature
baseline severity, 100% confident.
arch::arm64-macho ARM64 Mach-O binary
baseline severity, 100% confident.
binary Mach-O linked dylib
baseline severity, 100% confident.
binary/linking Mach-O linked dylib metadata
baseline severity, 80% confident.
binary/metrics No sentence-like strings
baseline severity, 100% confident.
build Mach-O UUID present
baseline severity, 95% confident.
dylib::usr/lib/libc-1 links /usr/lib/libc++.1.dylib (ZNSt12length_errorD1Ev, ZNSt20bad_array_new_lengthD1Ev, ZNSt3__113basic_istreamIcNS_11char_traitsIcEEED0Ev, ZNSt3__113basic_istreamIcNS_11char_traitsIcEEED1Ev, ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev, ... +68 more)
baseline severity, 95% confident.
dylib::usr/lib/libsystem/b links /usr/lib/libSystem.B.dylib (stack_chk_guard, dyld_stub_binder, stack_chk_fail, system, memset, ... +7 more)
baseline severity, 90% confident.
hardening::stack-chk-fail __stack_chk_fail function

Identity

SHA-256 6427baa1ce5ba37ff6cf3fff79b543018a0a8e8f088c3f66afb24561e4e9de43
Filename setup

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 26 Apr 2026 14:11 UTC
Last updated 26 Apr 2026 14:11 UTC

Labeling

Label bad
Label source harvest
Traits version bf48d