aa951c053baf011d08f3a60a10c1d09bbac32f332413db5b38b8737558a08dc1SHA-256 hash

Reported by 1 independent source · first reported 21 Jun 2023 by Elastic Security Labs · last reported 21 Jun 2023

Last reported 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

“| aa951c053baf011d08f3a60a10c1d09bbac32f332413db5b38b8737558a08dc1 | SHA-256 | /Users/Shared/sh.py | sh.py script |”

Elastic Security LabsVendor21 Jun 2023
Initial research exposing JOKERSPY

Indicators reported together

named in the same reports

code[.]appin 1 report
d895075057e491b3…c5c9bd3487d8in 1 report
55554944f74096a8…d97d1dff5cd4in 1 report
idea[.]appin 1 report
iterm[.]appin 1 report
452c832a17436f61…db9fb5a9aea1in 1 report
helper[.]appin 1 report
kextviewr[.]appin 1 report
app.influmarket[.]orgin 1 report
8ca86f78f0c73a46…d08ce11fa626in 1 report

Copy these 10 indicators · defanged

10 indicators, defanged, one per line

code[.]app
d895075057e491b34b0f8c0392b44e43ade425d19eaaacea6ef8c5c9bd3487d8
55554944f74096a836b73310bd55d97d1dff5cd4
idea[.]app
iterm[.]app
452c832a17436f61ad5f32ee1c97db05575160105ed1dcd0d3c6db9fb5a9aea1
helper[.]app
kextviewr[.]app
app.influmarket[.]org
8ca86f78f0c73a46f31be366538423ea0ec58089f3880e041543d08ce11fa626

Thanks — we review every report.

Report a wrong value