Open-source atomic malware analysis

Analyze another

upd.xz

XZ
Verdict: SUSPICIOUS
SHA256: 733feb7077f7586191c0646a0f57c07c0d484146b2b3c1ac08e75e4bb3216af2
Mal-ecule
KO₆(CaAlCoDyIAs₃)H₇(Cm₃DsF₂HfOsPo₃Db₂)Md(Si)
Size 111.4 KB download
First seen 117 days ago
Analyzed 115 days ago
Ecosystem malcontent-samples

Objectives

suspicious severity, 95% confident.
credential-access/validation macOS CoreServices password authentication
notable severity, 80% confident.
collection Enumerates macOS user directories
notable severity, 90% confident.
discovery/system Collects macOS hardware UUID
notable severity, 90% confident.
impact/ransom User-targeted destructive file operations

Micro-behaviors

notable severity, 66% confident.
communications/socket Uses send socket call
notable severity, 85% confident.
dylib ObjC method swizzling via runtime
notable severity, 80% confident.
fs/file Read file status and metadata (core)
notable severity, 95% confident.
os/security/auth macOS CSIdentity password authentication
notable severity, 95% confident.
process/create Executes command and captures output
notable severity, 70% confident.
process/fd freopen stream redirection import
baseline severity, 100% confident.
os Access /dev/urandom

Metadata

notable severity, 100% confident.
signed Ad-hoc Signature
baseline severity, 100% confident.
arch::arm64-macho ARM64 Mach-O binary
baseline severity, 100% confident.
binary Binary has low average string entropy
baseline severity, 100% confident.
binary/linking Mach-O linked dylib metadata
baseline severity, 100% confident.
build Mach-O UUID present
baseline severity, 95% confident.
dylib::system/library/frameworks/corefoundation/framework/versions/a links /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation (CFConstantStringClassReference, kCFAllocatorDefault, CFArrayGetCount, CFArrayGetValueAtIndex, CFRelease, ... +4 more)
baseline severity, 95% confident.
dylib::system/library/frameworks/coreservices/framework/versions/a links /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices (CSGetDefaultIdentityAuthority, CSIdentityAuthenticateUsingPassword, CSIdentityQueryCopyResults, CSIdentityQueryCreateForName, CSIdentityQueryExecute)
baseline severity, 95% confident.
dylib::system/library/frameworks/foundation/framework/versions/c links /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation (OBJC_CLASS_$_NSAppleScript, OBJC_CLASS_$_NSString)
baseline severity, 95% confident.
dylib::system/library/frameworks/iokit/framework/versions/a links /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit (kIOMasterPortDefault, IOObjectRelease, IORegistryEntryCreateCFProperty, IORegistryEntryFromPath)

20 of 36 traits shown

Identity

SHA-256 733feb7077f7586191c0646a0f57c07c0d484146b2b3c1ac08e75e4bb3216af2
Filename upd.xz

Origin

Source harvest
Feed datasets
Ecosystem malcontent-samples

Timeline

First seen 24 Apr 2026 16:18 UTC
Last analyzed 26 Apr 2026 12:52 UTC
Last updated 26 Apr 2026 12:52 UTC

Labeling

Label bad
Label source harvest
Traits version bf48d