lightspy | 4b973335755bd8d48f34081b6d1bea9ed18ac1f68879d4b0a9211bbab8fa5ff4

General

Target
4b973335755bd8d48f34081b6d1bea9ed18ac1f68879d4b0a9211bbab8fa5ff4
Size 420KB
Sample260923-nerxsasdqa
SHA256 4b973335755bd8d48f34081b6d1bea9ed18ac1f68879d4b0a9211bbab8fa5ff4
MD5 2178d673779605ffb9cf7f2fa3ec8e97
SHA1 afd03337d1500d6af9bc447bd900df26786ea4a4
SHA512 fe8c1e871cb21b12a025cfdeed13c4629ac8870e213781c09643ca59a1aab44576efea0fa4d62498e90b70d3d7316e65f920f39a6cd905340ad575257efa2785
SSDEEP 6144:7VcRQsUU/lgoE5edBgYuzbMZ/8sLURYhEi6lRk2ITcW6/V:pNagl5eTgYD8kf69
TLSH
T17F94092FF705091FC19E8179823F1312A3BAF6229F2067D716D89039EFD5A916F52B81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: LightSpy
LightSpy is a modular spyware framework first seen in 2020 and linked to APT41. Alongside iOS and Android implants, it ships Windows and macOS loaders that pull plugins from a C2 manifest.
trojan stealer backdoor loader lightspy

Detects LightSpy macOS loader 1 IoCs

loader apt apt41

resource	yara_rule
sample	family_lightspy_macos_loader

SHA256 4b973335755bd8d48f34081b6d1bea9ed18ac1f68879d4b0a9211bbab8fa5ff4
MD5 2178d673779605ffb9cf7f2fa3ec8e97
SHA1 afd03337d1500d6af9bc447bd900df26786ea4a4
SHA512 fe8c1e871cb21b12a025cfdeed13c4629ac8870e213781c09643ca59a1aab44576efea0fa4d62498e90b70d3d7316e65f920f39a6cd905340ad575257efa2785
SSDEEP 6144:7VcRQsUU/lgoE5edBgYuzbMZ/8sLURYhEi6lRk2ITcW6/V:pNagl5eTgYD8kf69
TLSH
T17F94092FF705091FC19E8179823F1312A3BAF6229F2067D716D89039EFD5A916F52B81
MD5 SHA1 SHA512 SSDEEP TLSH

macos arch:x64