Classification: Malicious
localfile~.x64.macho is a trojan (macOS Mach-O executable, 9.8 MB). Detected by 42 antivirus engines. Linked to Lazarus Group activity.
Detection summary
- 42 antivirus detections
- 0 IDS alerts
- 2 processes observed
- 0 contacted hosts
- 0 DNS requests
Blacklist sightings
| Description |
Source |
First seen |
Last seen |
Labels |
MITRE ATT&CK |
| Lazarus Group |
MalwarePatrol |
2026-03-03 17:46:44 |
2026-03-03 18:01:05 |
malicious-activity
|
G0032 Lazarus Group
|
| Generic Malware |
Hybrid-Analysis |
2025-04-12 04:00:06 |
2025-04-12 06:30:18 |
|
|
Tags
lazarus group
apt38
nickel academy
hidden cobra
dark seoul
diamond sleet
dev-0139
sectora01
genie spider
atk3
operation darkseoul
copernicium
zinc
labyrinth chollima
covellite
unit 121
stardust chollima
bureau 121
citrine sleet
sapphire sleet
operation applejeus
ta404
andariel
apt-c-26
operation ghostsecret
beagleboyz
g0082
group 77
whois hacking team
newromanic cyber army team
bluenoroff
operation troy
hastati group
appleworm
atk117
g0032
dev-1222
nickel gladstone
gleaming pisces
Sample information
- Filenames
- localfile~.x64.macho
- File type
- Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|D ...
- Size
- 10249264 bytes
- MD5
d8508b3c7ba4f2b9ed1cf3ff28fd6b83- SHA-1
4a93fe1e7fce91f3c3d99c733d9628ed952dbf2a- SHA-256
48ee5d0d44a015876d867fa515b04c1998fecf19badcbd69f4f3fa8497d57215- First indexed
- 2025-04-12 03:38:20
- Last updated
- 2026-04-09 01:56:29
Antivirus detections
| Engine | Detection |
|---|
| ALYac | Trojan.OSX.Nukesped |
| AVG | MacOS:DangerousSig [Trj] |
| AhnLab-V3 | Trojan/OSX.Agent |
| Antiy-AVL | Trojan/MacOS.NukeSped |
| Arcabit | Trojan.MAC.NukeSped.A |
| Avast | MacOS:DangerousSig [Trj] |
| Avira | OSX/NukeSped.osiep |
| BitDefender | Trojan.MAC.NukeSped.A |
| CTX | macho.trojan.nukesped |
| Cynet | Malicious (score: 99) |
| DrWeb | Mac.Launcher.2 |
| ESET-NOD32 | OSX/NukeSped.AR |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.MAC.NukeSped.A (B) |
| F-Secure | Malware.OSX/NukeSped.osiep |
| FireEye | Trojan.MAC.NukeSped.A |
| Fortinet | OSX/NukeSped.AR!tr |
| GData | Trojan.MAC.NukeSped.A |
| Google | Detected |
| Ikarus | Trojan.OSX.Nukesped |
| K7GW | Trojan ( 0040f5531 ) |
| Kaspersky | HEUR:Trojan.OSX.Nukesped.a |
| Kingsoft | Win32.Troj.Undef.a |
| Lionic | Trojan.OSX.NukeSped.4!c |
| McAfee | OSX/Agent.at |
| MicroWorld-eScan | Trojan.MAC.NukeSped.A |
| Microsoft | Trojan:MacOS/Nukesped!MTB |
| Skyhigh | OSX/Agent.at |
| Sophos | OSX/NukeSped-BJ |
| Symantec | OSX.Trojan.Gen |
| Tencent | Osx.Trojan.Nukesped.Cnhl |
| TrendMicro | TROJ_FRS.0NA103KI24 |
| TrendMicro-HouseCall | TROJ_FRS.0NA103KI24 |
| VIPRE | Trojan.MAC.NukeSped.A |
| Varist | MacOS/Nukesped5.AB |
| ViRobot | Trojan.MacOS.S.Agent.10249264 |
| ZoneAlarm | OSX/NukeSped-BJ |
| alibabacloud | Trojan:MacOS/NukeSped.AV |
| huorong | Trojan/Generic!115E6100CFB98B94 |
| ESET-NOD32 | OSX/NukeSped.AR trojan |
| Rising | Trojan.NukeSped/OSX!8.10A21 (KTSE) |
| TrellixENS | OSX/Agent.at |
Process list
| Name | Command line |
|---|
| sudo | sudo /Users/hapubws/localfile~.x64.macho |
| localfile~.x64.macho | /Users/hapubws/localfile~.x64.macho |