Hostile ^100% Download

Cleaner

macOS Stealer v2 build identifier

macOS Stealer v2 root-entitled encrypted file collectorRoot-entitled CommonCrypto recursive file collector

SHA-25673491d3f3bcfe0c1d4ebefecf8230d0c460fa89703381d9b8923daaa4be170f4

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK₂(McTe)O₃(CaCoP₂)H₄(Os₂CrF₄Po₇)Md₃(Bi₂Si₃)

Evidence

macOS Stealer v2 build identifier 0x5166c–0x5181c

⋯7 more rows
0x516dc00000000d91200000100000100000000................
0x516ec00000000161300000100000100000000................
0x516fc00000000531300000100000100000000....S...........
0x5170c00000000901300000100000100000000................
0x5171c00000000cd1300000100000100000000................
0x5172c00000000d51300000100000100000000................
⋯15 more rows

CommonCrypto CCCrypt import 0xaaca7–0xaaec7

⋯3 more rows
0xaacd7657865637574655f686561646572005fexecute_header._
0xaace743434372797074005f43434b65794465CCCrypt._CCKeyDe
0xaacf77269766174696f6e50424b4446005f5frivationPBKDF.__
0xaad07556e77696e645f526573756d65005f5fUnwind_Resume.__
0xaad175a4e4b537431316c6f6769635f657272ZNKSt11logic_err
⋯8 more rows
0xaada761746f7231335f5f6465726566657265ator13__derefere
0xaadb76e63654576005f5f5a4e4b5374335f5fnceEv.__ZNKSt3__
0xaadc731345f5f6673313066696c657379737414__fs10filesyst
0xaadd7656d32387265637572736976655f6469em28recursive_di
0xaade7726563746f72795f6974657261746f72rectory_iterator
0xaadf731335f5f64657265666572656e63654513__dereferenceE
0xaae0776005f5f5a4e4b5374335f5f31345f5fv.__ZNKSt3__14__
0xaae176673313066696c6573797374656d3238fs10filesystem28
0xaae277265637572736976655f646972656374recursive_direct
0xaae376f72795f6974657261746f7235646570ory_iterator5dep
0xaae4774684576005f5f5a4e4b5374335f5f31thEv.__ZNKSt3__1
0xaae57345f5f6673313066696c6573797374654__fs10filesyste
⋯7 more rows

C++ filesystem copy operation 0xab7a8–0xab8b8

⋯3 more rows
0xab7d8656c656173655f7765616b4576005f5felease_weakEv.__
0xab7e85a4e5374335f5f31345f5f6673313066ZNSt3__14__fs10f
0xab7f8696c6573797374656d31315f5f636f70ilesystem11__cop
0xab808795f66696c6545524b4e53315f347061y_fileERKNS1_4pa
0xab81874684553345f4e53315f3132636f7079thES4_NS1_12copy
0xab8285f6f7074696f6e7345504e535f313065_optionsEPNS_10e
0xab83872726f725f636f646545005f5f5a4e53rror_codeE.__ZNS
0xab84874335f5f31345f5f6673313066696c65t3__14__fs10file
⋯7 more rows

Imports C popen command-pipe API 0xac12e–0xac32e

⋯6 more rows
0xac18e5f66636c6f7365005f66666c75736800_fclose._fflush.
0xac19e5f6667657473005f666f70656e005f66_fgets._fopen._f
0xac1ae6f726b005f6672656164005f66736565ork._fread._fsee
0xac1be6b005f667365656b6f005f6673746174k._fseeko._fstat
0xac1ce005f6674656c6c6f005f667772697465._ftello._fwrite
0xac1de005f6765747077756964005f67657475._getpwuid._getu
0xac1ee6964005f6d656d636872005f6d656d63id._memchr._memc
0xac1fe6d70005f6d656d637079005f6d656d6dmp._memcpy._memm
0xac20e6f7665005f6d656d736574005f6d6d61ove._memset._mma
0xac21e70005f6d756e6d6170005f6f70656e00p._munmap._open.
0xac22e5f70636c6f7365005f706f70656e005f_pclose._popen._
0xac23e736574627566005f736574736964005fsetbuf._setsid._
0xac24e7374726c656e005f73797374656d0064strlen._system.d
0xac25e796c645f737475625f62696e64657200yld_stub_binder.
⋯13 more rows

Temporary exception for file read access 0xae400–0xae5c0

⋯7 more rows
0xae47065000000000000000000000000000000e...............
0xae480fade0cc0000010520000000500000000.......R........
0xae490000000340000000200000c5400000005...4.......T....
0xae4a000000c600000000700000eff00010000...`............
0xae4b00000104afade0c0200000c2000020400...J....... ....
0xae4c000000002000001400000005800000007[email protected]....
0xae4d000000057000564802002000c00000000...W..d. .......
0xae4e000000000000000000000000000000000................
0xae4f000000000000000000000000000000000................
0xae500000480000000000000000001436c6561............Clea
0xae5106e657200827509cf7ca5747b013626a3ner..u..|.t{.6&.
0xae5208abc8115a1af334659c6bf1528ad7556......3FY...(.uV
⋯10 more rows