MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AMOS


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1
SHA3-384 hash: 681bdf392d05223039fd7084c7d5865eb4b58ade9481216f5200e8e092800be9b75413a3b390c5e88b29364486389ab0
SHA1 hash: 3bc874603ab271dddd507dcdd201d0a4a05606db
MD5 hash: 057e87fb81fe57fc6bcc006a6cffa2be
humanhash: sodium-iowa-bluebird-freddie
File name:AccountsHelper
Download: download sample
Signature AMOS
Create hunting rule
File size:356'496 bytes
First seen:2026-07-14 13:59:07 UTC
Last seen:Never
File type:php macho
MIME type:application/x-mach-binary
ssdeep 6144:8df1hQZ4K/5Oj8yXQaPHm+Ol6KwNQhjeyHL:8dNWjVDafmHw8
TLSH T138747C5B263D16B0C4CCF27855875F2FEB24FC151470A36A4F44AB249EFA3669E0A31E
TrID 82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5)
17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika macho
Reporter tea_not_stirred
Tags:AMOS ClickFix machO macOS osx.amos Poseidon

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
JP JP
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5643df56bd89099b553fa7
Tags:
n/a
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
stealer
Link:
https://www.filescan.io/uploads/6a5643df5212ca43d7fedd84/reports/141e9797-d614-4bd7-9077-90f24f67a3eb/overview
Verdict:
Malicious
Labled as:
Mac/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1
Verdict:
Malicious
File Type:
macho fat
First seen:
2026-07-14T11:15:00Z UTC
Last seen:
2026-07-14T11:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
Mach-O universal binary
Link:
https://malprob.io/report/23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1/
Threat name:
MacOS.Infostealer.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-14 14:13:45 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ep4qb2p3r72x6qqjaelyucd4yvlq3sxr7ulb3dumbm4pzw2ondyq._file
Malware family:
AMOS
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/23f900e9fb8f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AMOS

php macho 23f900e9fb8ff57f420901178a087cc5570dcaf1fd161d8e8c0b38fcdb4e68f1

(this sample)

  
Delivery method
Distributed via web download

Comments