55554944f74096a836b73310bd55d97d1dff5cd4SHA-1 hash

Reported by 1 independent source · first reported 21 Jun 2023 by Elastic Security Labs · last reported 21 Jun 2023

Last reported 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

“The version observed by Elastic Security Labs is signed as XProtectCheck-55554944f74096a836b73310bd55d97d1dff5cd4 , and has a code signature resembling publicly known and untrusted payloads.”

Elastic Security LabsVendor21 Jun 2023
Initial research exposing JOKERSPY

Indicators reported together

named in the same reports

code[.]appin 1 report
d895075057e491b3…c5c9bd3487d8in 1 report
idea[.]appin 1 report
iterm[.]appin 1 report
452c832a17436f61…db9fb5a9aea1in 1 report
helper[.]appin 1 report
kextviewr[.]appin 1 report
app.influmarket[.]orgin 1 report
8ca86f78f0c73a46…d08ce11fa626in 1 report
aa951c053baf011d…737558a08dc1in 1 report

Copy these 10 indicators · defanged

10 indicators, defanged, one per line

code[.]app
d895075057e491b34b0f8c0392b44e43ade425d19eaaacea6ef8c5c9bd3487d8
idea[.]app
iterm[.]app
452c832a17436f61ad5f32ee1c97db05575160105ed1dcd0d3c6db9fb5a9aea1
helper[.]app
kextviewr[.]app
app.influmarket[.]org
8ca86f78f0c73a46f31be366538423ea0ec58089f3880e041543d08ce11fa626
aa951c053baf011d08f3a60a10c1d09bbac32f332413db5b38b8737558a08dc1

Thanks — we review every report.

Report a wrong value