Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain
Threat Actors
Malware Families
Excerpt
Infostealers targeting macOS have continued to proliferate over the last two years, with threat actors iterating on successful techniques across related malware families. Researchers at Moonlock, Jamf, and Malwarebytes have previously documented the rise of SHub Stealer, including its use of fake application installers and “ClickFix” social engineering. This week, SentinelOne observed a new SHub variant using the build tag “Reaper”. Reaper uses fake WeChat and Miro installers…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://hebsbsbzjsjshduxbs.xyz/api/bot/heartbeat | High | Score 58/100 | First seen |
| SHA256 | 6552824c59ddacb134073f24a4bd4724514a938a9dc59f1733503642faed3bd3 | Medium | Score 53/100 | First seen |
| URL | https://hebsbsbzjsjshduxbs.xyz/gate | High | Score 58/100 | First seen |
| MD5 | c917fcf8314228862571f80c9e4a871e | Medium | Score 53/100 | First seen |
| Domain | mlcrosoft.co.com | High | Score 63/100 | First seen |
| Domain | qq-0732gwh22.com | High | Score 58/100 | First seen |
| URL | https://hebsbsbzjsjshduxbs.xyz/api/debug/event | High | Score 58/100 | First seen |
| Domain | mlroweb.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…