SUSP_MacOS_Bash_System_Recon_Bundle_Aug26

Rule Info

Name
SUSP_MacOS_Bash_System_Recon_Bundle_Aug26
Author
MalGamy
Description
Detects a bash script harvesting CPU, memory, OS version and public IP together, characteristic of infostealer targeting recon
Score
65
Date
2026-08-19
Minimum Yara
3.5.0
Rule Hash
9f0bb4ab323b3528d09de74bef84ddad
Tags
['MACOS', 'SUSP', 'SCRIPT', 'T1059_004']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
7
Suspicious (< 10 engines)
2
Clean (0 engines)
45

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-11-05 11:14:49
0
62
169b2da604786c1655c719b4926d99cffc609c4bc410941197b764e0d0356d0a
2026-11-05 11:14:29
0
62
0862fb6475f9b4fc9c36f8beafbf6b85e44107477a0b8da9d2d3c3975cc46bd8
2026-11-05 11:14:29
0
62
e1c232e4641862747cc5a6ef5b7506a1c386bb566fa3f15c7596082c61ddc099
2026-11-05 11:14:29
0
62
a4c1912ace43274b350bfba8dfd98dd60d741c7390cd6b6096d138c0e0f71773
2026-11-05 11:14:29
0
55
ffb8334cc6efc8d878f0b7aff7877322b3bbdcb9fea724bbde6041d6dab38067
2026-11-05 10:07:00
23
55
a8015338feef973c011c3f1e332cae0c00f1b372c1666df1c2315f84649d2d60
2026-11-05 05:46:41
0
62
f07823efcd527d92d8f2674ba24b178f312f6541e7be132984221182d1a3c441
2026-11-05 00:21:09
0
62
fab64b886845e31cfa7045851e8801e04a24f32c042442323c0915a2a95bdee1
2026-11-04 20:09:32
0
61
5eec97506127cb3d6d5798761bcf5284e718248a95921c4ecd87292353c5d323
2026-11-03 23:12:39
0
61
5013f794d49738e7770f62886e014168ac8b10c0d1d2c2be2728e506676b84bb
2026-11-03 23:09:50
0
61
928bbb39daba0ce40bc0ac7d5ac4e019dfdb9571a5b62bfad49a0495cf99337b
2026-11-03 20:22:19
0
62
d1238a6495224c152531efd9863a46be22d264e9e26a455866c4ab80b78aa6a2
2026-10-31 03:17:27
0
62
35575f711befb3c275ec26c1bb200d19685b03503bad29c025ac3ecb51a9f193
2026-10-30 04:33:07
0
59
06ca6a4daa82e6445e594dc3d04cc3c00c0bc6dcb318007437e8bed5934ce995
2026-10-30 01:57:08
0
62
bf5a7f69a933965746d869bf286aed88a5e64e98f93cc282bf4156d351d3c464
2026-10-30 01:13:16
0
62
b041326a99607e58915473a8effe88768bfdb4cc740d499475539e200158722a
2026-10-28 21:10:36
0
62
8d42142f82356fdac58e3a060cc2658bee5a24a452e04b5f6b0106cd0dcbf58e
2026-10-26 19:21:28
0
61
fe5400def6b217c7509c45987cd74665a8f6f9e7bf167c990e5789250caa6790
2026-10-24 23:12:36
0
62
091ee5d25fba8793bddcfa884998ebafed32e50184294e6d28f69cce9d0b8e83
2026-10-24 04:39:40
0
61
37bee14bcfe8d847fcaa582fe2fa4673cc082a86abd6916886d0a96f33a2b27d
2026-10-23 21:27:17
0
62
2d69de4c0c9677bd0bed11a8901eda840bb56ee2ae23652ef56d5b2542b26f5e
2026-10-23 00:09:49
0
62
2cce282d8e3bf7029bc5a1bfc5bc5655effabfc82dc88e5f0d733cf9ac9fe3e5
2026-10-22 19:09:26
0
62
36fe84b040d341d8b7b0ca00c00cd869d6e0f3891036f73180b40b6aa50c0770
2026-10-19 23:58:16
0
62
3e1f35a5264f0e77a1219dd119953b31a3314cf4595047f858ff18f03b5079f2
2026-10-19 23:58:16
0
62
a9d69857a511bb3d954d7b2ab1941972a496da6fc097f56a91596d274e71638b
2026-10-19 22:50:27
0
62
3b5f1782ffff0d79750ed6fa6f8a3dc10b8c9bd0f40911a252d9f4aa53e8a8cc
2026-10-19 18:38:56
0
62
7989a705bdec8c98d59828e81bd6069006a062c5572239798472529923f705d9
2026-10-19 05:14:44
0
61
8e6551951ba0752e1d1b91ad20756206525b03d3b12062218619fc45c8e58939
2026-10-18 20:29:37
0
62
2890a0c90f8ee670a7ce920015d0106688aaaa8f9d530b07f3203850b8e24364
2026-10-18 13:24:06
0
61
5bf38e37c2d885ddcd3a973c5de9b39581d3be1fbc43ce6bd9ae88959f676deb
2026-10-18 00:01:16
0
62
014ac7fd64d630f71feee322a94649aba9d3a2911984b63d6636eeef29b24a40
2026-10-17 14:15:16
0
62
360a9ca5e9ec4dc814d4992ed717ee73216644af137bf8a3ce7e330ad8b49cc8
2026-10-17 14:10:36
0
62
86469482247e58d9fa58abd31e1aff43a167766b52080483b6810dd70fd89063
2026-10-17 14:10:25
0
62
ff7b4bdd126051669c1f0c10d7eaa8bff00513ce62b3a1551e7f706224532118
2026-10-16 10:41:57
0
62
911e019d96429d493974b4fd7721795bcd1060d16b62883dd6c81c69fdf1196a
2026-10-14 11:49:18
0
62
f10edd37335ace4abfedb91b86cd52846a8c66c2a14faedd3254ac231220cdd3
2026-10-14 01:11:36
0
63
b7fb42036a7a2b1be39d1637caee07bfc058e8c187cf579262cc8220485b97df
2026-10-11 22:19:36
0
62
f1dbaca208b8340daf4e1e8333f5cc3e5cbfde8004bdba15547dd2e420a35c18
2026-10-08 02:10:26
11
62
9627b0e9001d2f68bb395b0ee034c8cf5547f88b4b64a4b732d6594ea53fcdcf
2026-10-07 22:06:48
0
62
5a09077b728efcfe5530b1765ff89a214340545cfe59288e65109266bbfc9a54
2026-10-07 22:06:47
0
62
d505e829ff61348411633800cd04bd2425594a4cc48d6dc07661fc5af98ac1ba
2026-10-07 22:06:47
0
62
9de3b32bbd78524fbedc095cc59d07f8cd3fa0f8aa3a32fd122b0eaac93faafb
2026-10-04 06:52:46
0
62
6e416741b3c403d3b152f7c21ac64d9ee3023f862b10882b7a0ca98cc15bf1ab
2026-10-04 05:38:56
0
56
66866de4ea6f1b6139f11f6f23678503e53319d74730dbb47f8b52fb90ce0bf7
2026-09-29 22:47:16
1
57
d74285a907bf15e11707eac5968d25aa6930a2ab6ad6ed5ef30feb6bc387df0f
2026-09-29 21:51:06
31
62
3ce0504ba65f8d56f83d7fef45faeaeb31e4e5aa9b872b56610b5f2558231caa
2026-09-29 18:19:56
22
61
5494e26f2fea646ae9e91a0ea4f52c67e6f2d74cc527d8ecb85c30e374e6b748
2026-09-29 18:15:57
23
62
ebe1ec8308eff71642617d3655b4da94390b24ac26172fe6fdcd5735eda5d366
2026-09-29 18:15:47
20
62
5c59582a5950720a5f300f41a0616c29fe9161e1f07fae0ccb0817b507d5b627
2026-09-25 23:58:57
1
62
e2a00e3de3c18e3893d539e710675b9c8ede65e762ce08c3bc412fc0b2611aa3
2026-09-25 23:53:53
0
62
b724fc0e2c79092ff9b14f292d49174112df0c9d1b3925494b2b08a9d2fb8283
2026-09-25 05:13:36
0
56
4b8eb01e6e209c9fb79a3ac60676c7f2f131af1f989dca989231f8485184566e
2026-09-23 11:52:56
0
63
e216d95e0bda601b14b8a1d6e6595d2943a6cedc7c389ecefa091a43a2394293
2026-09-22 23:07:28
12
62
9d87b41c2b29ccbeac851b98f1a7dce4ab4781fec0cbc55fa6f93a6299a3d564

Rule Matches per Month (last 24 months)