- First seen
- Last seen
THREAT SIGNALMedium
Read alongside the verdict
Indicator overview
INDICATOR PROFILEVirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
- SHA256
3fa5c736efc543db373581f2e22addff05516fbc2b606fa04ff47488eae60f7e- SHA1
35d9804fe024ddfe8e17a3cd055274fb223af6e7- MD5
2bcc06464a66e5d76ff5fb5963f158ae- Filename
- 3fa5c736_cbc84yor3esw75i9.bin
- File type
- macho
- MIME
- application/x-mach-binary
- File size
- 811040
- TLSH
T1850517173379540ADC1A71387F926DB6FA20B5B66320E89B5E0B1210DFF50789B1A27F- SSDEEP
12288:ijp0QoUrfLPg7dMqUaAhooQeJbef8qfBmPunkT2P3C:8pkGtJSf8Lu1y
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
High-confidence evidence. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (29%).
Confidence signal
VirusSign reports 97% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections29%
VirusSign confidence97%
Relationship context15 visible
Threat classificationstealer
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
20%
critical
macho
384784 bytes
contains
Filename
b3912c14_localfile~.x64.bin
Family
stealer
Type
trojan
File type
macho
MIME
application/x-mach-binary
19%
critical
macho
401440 bytes
contains
Filename
b042bacd_localfile~.arm64.bin
Family
stealer
Type
trojan
File type
macho
MIME
application/x-mach-binary
0%
text
422 bytes
drops
Filename
f2b6a234_default_wallet.bin
File type
text
MIME
text/plain
Size
422
SHA1
437ffadb3b7235993becac66e0b2c8348839963d
0%
shell
52 bytes
drops
Filename
c50e439d_23c9257b-e63c-4818-ba5f-1c9e4118afd9.session.bin
File type
shell
MIME
text/plain
Size
52
SHA1
8a65c0296ea6a10fae860ae37175bf9f44413920
0%
zip
68005 bytes
drops
Filename
c0177591_180b6f3cb268d4d18e1b5d49e8562bc9.zip.bin
File type
zip
MIME
application/zip
Size
68005
SHA1
f9d047146884bc14409a3f71ceae7e585fec4437
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
104.21.0.0/17
Network
104.16.0.0-104.31.255.255
First seen
2023-09-30T17:34:52Z
Last seen
2026-11-13T05:49:38Z
0%
GB
communicates
CIDR
17.253.36.0/22
Network
17.0.0.0-17.255.255.255
First seen
2023-10-13T20:43:09Z
Last seen
2026-11-14T01:30:37Z
0%
US
communicates
CIDR
17.253.4.0/22
Network
17.0.0.0-17.255.255.255
First seen
2024-03-03T11:29:46Z
Last seen
2026-11-14T00:31:38Z
0%
GB
communicates
CIDR
17.253.36.0/22
Network
17.0.0.0-17.255.255.255
First seen
2023-10-09T12:04:50Z
Last seen
2026-11-14T01:30:15Z
0%
GB
communicates
CIDR
17.253.36.0/22
Network
17.0.0.0-17.255.255.255
First seen
2023-10-14T21:02:16Z
Last seen
2026-11-14T01:09:37Z
Related domains
Domains associated with this indicator.
5shown
38%
high
.com
communicates
Root
isosissisisossfiof.com
TLD
com
First seen
2026-08-22T09:37:29Z
Last seen
2026-11-13T10:37:21Z
35%
medium
.pro
communicates
Root
shopguoerve.pro
TLD
pro
First seen
2026-07-09T13:15:27Z
Last seen
2026-11-14T01:26:27Z
38%
medium
.icu
communicates
Root
lewokodwqko.icu
TLD
icu
First seen
2026-07-09T16:34:38Z
Last seen
2026-11-14T01:26:38Z
43%
high
.info
communicates
Root
dfsjfisafosdikfos.info
TLD
info
First seen
2026-07-10T13:54:28Z
Last seen
2026-11-13T05:49:39Z
0%
.net
communicates
Root
akamaiedge.net
TLD
net
Subdomain
e4805.dsca
First seen
2023-09-29T04:59:22Z
Last seen
2026-11-14T01:45:23Z
Analysis details
Severity: criticaltrojanpassword-dialog64bitos-credentialsbrowser-credsenv-checkchecks-vmcrypto-walletsself-signedmulti-archmachoarm
Freshness: Fresh · Last seen today.
- Detection rate
- 29%
- Threat type
- trojan
- Family
- stealer
- Confidence
- 97%
- confidence
- 97 · VirusSign confidence; engine detections are reported separately.
Overview
- SHA256
3fa5c736efc543db373581f2e22addff05516fbc2b606fa04ff47488eae60f7e- SHA1
35d9804fe024ddfe8e17a3cd055274fb223af6e7- MD5
2bcc06464a66e5d76ff5fb5963f158ae- Filename
- 3fa5c736_cbc84yor3esw75i9.bin
- File type
- macho
- MIME
- application/x-mach-binary
- File size
- 811040
- TLSH
T1850517173379540ADC1A71387F926DB6FA20B5B66320E89B5E0B1210DFF50789B1A27F- SSDEEP
12288:ijp0QoUrfLPg7dMqUaAhooQeJbef8qfBmPunkT2P3C:8pkGtJSf8Lu1y- First seen
- 2026-11-12T18:52:26Z
- Last seen
- 2026-11-13T05:49:35Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
High-confidence evidence. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. A limited set of engine detections is present (29%).
Confidence signal
VirusSign reports 97% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family stealer.
Relationship context
15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2023-09-29 to 2026-11-12. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family stealer.
Last seen today.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 3fa5c736_cbc84yor3esw75i9.bin
- File type
- macho
- MIME
- application/x-mach-binary
- Size
- 811040
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Classification label
- Connects to IPs without corresponding DNS lookups
- Contains symbols with suspicious names likely related to encryption
- Creates hidden files, links and/or directories
- Detect curl execution fetching remote content which is often used by installers or scripts. Requires curl/wget/fetch to be the executing process.
5 shown
View MITRE ATT&CK details · 5 shown
- T1564.001 — Creates hidden files, links and/or directoriesTactics: TA0005
- T1059.002 — Executes Apple scripts and/or other OSA language scripts with shell command 'osascript'Tactics: TA0002
- T1068 — Executes Apple scripts that request for passwords (for privilege escalation or leakage)Tactics: TA0004
- T1064 — Executes commands using a shell command-line interpreterTactics: TA0002 · TA0005
- T1082 — Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configurationTactics: TA0007
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, UDPports 443, 80, 53
- 5+ outbound connections observed
- 0 domains, 5+ IPs, 0 URLs
- Common ports: 443, 80, 53
- Protocols: TCP, UDP
View details · 5 shown
- IP
- 151.101.3.6
- Port
- 443
- Protocol
- UDP
- IP
- 151.101.3.6
- Port
- 443
- Protocol
- TCP
- IP
- 151.101.131.6
- Port
- 443
- Protocol
- UDP
- IP
- 51.94.136.141
- Port
- 443
- Protocol
- TCP
- IP
- 23.222.244.213
- Port
- 443
- Protocol
- TCP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- shopguoerve.pro
- Type
- A
- Answers
- 172.67.164.79, 104.21.74.230
- Response
- NOERROR
- Query
- lewokodwqko.icu
- Type
- A
- Answers
- 104.21.7.202, 172.67.188.1
- Response
- NOERROR
- Query
- isosissisisossfiof.com
- Type
- A
- Answers
- 104.21.41.117, 172.67.164.190
- Response
- NOERROR
- Query
- dfsjfisafosdikfos.info
- Type
- A
- Answers
- 172.67.198.67, 104.21.36.181
- Response
- NOERROR
- Query
- s.mzstatic.com
- Type
- A
- Answers
- 17.253.7.137, 17.253.7.151
- Response
- NOERROR
5 shown
C2 candidates4
DNSports 53
- 4 C2 candidate communications
- 4 domains, 4 IPs
- Common ports: 53
- Protocols: DNS
View details · 4 shown
- IP
- 172.67.164.79
- Domain
- shopguoerve.pro
- Port
- 53
- Protocol
- DNS
- IP
- 104.21.7.202
- Domain
- lewokodwqko.icu
- Port
- 53
- Protocol
- DNS
- IP
- 172.67.164.190
- Domain
- isosissisisossfiof.com
- Port
- 53
- Protocol
- DNS
- IP
- 172.67.198.67
- Domain
- dfsjfisafosdikfos.info
- Port
- 53
- Protocol
- DNS