MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 4903c40fbdb96cf39f35ed592a886a39d230564b26dd80aef3fa6c58bc501551. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AMOS
Vendor detections: 8
| SHA256 hash: | 4903c40fbdb96cf39f35ed592a886a39d230564b26dd80aef3fa6c58bc501551 |
|---|---|
| SHA3-384 hash: | 77f3a78b25c7082c41b3e1d810b47b3252b05f9375f1c0642ad4f32dde53a9399b03bf477ed9931573e5cc9d698b6048 |
| SHA1 hash: | 5f71d4d68561a3703a76415c567c4daf783c4c2e |
| MD5 hash: | c062704203b38a7c4d6e21cd44082d86 |
| humanhash: | bravo-violet-colorado-muppet |
| File name: | stage4_buildA.macho |
| Download: | download sample |
| Signature | AMOS |
| File size: | 330'592 bytes |
| First seen: | 2026-09-09 14:50:57 UTC |
| Last seen: | Never |
| File type: |  macho |
| MIME type: | application/x-mach-binary |
| ssdeep | 6144:vGJY87pyLobY1WLtxu47fbbgkQlyLIbYNWLtxui7:vGJY8AQfbbgkxq |
| TLSH | T1E264F151F73EA544C46CD3B83DCF8F532112B8710EA621B76B20EA9C2A165D2771EF1A |
| TrID | 82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2) |
| Magika | macho |
| Reporter |  2opremio |
| Tags: | AMOS ClickFix machO macOS packed |
2opremio
ClickFix stage 4, packed Mach-O universal (x86_64 + arm64), ad-hoc signed, Identifier setup-ccc431a174b8cc933fa2eb49ee3c49293864cc06, CDHash 3d87d76b202d44445220918a747ccfa9fc3c7ba3, no Team ID. Served by shelternode18[.]com. Carries the stage 5 AppleScript encrypted with ChaCha20-Poly1305 in 7 authenticated chunks behind an 88529-iteration key stretch. Build hashes rotate roughly hourly.Intelligence
File Origin
# of uploads :
1
# of downloads :
347
Origin country :
ESVendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Tags:
malware
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Verdict:
Malicious
Labled as:
Mac/malicious_confidence_100%
Verdict:
Malicious
File Type:
macho fat
First seen:
2026-09-09T14:42:00Z UTC
Last seen:
2026-09-10T21:08:00Z UTC
Hits:
~10
Score:
100%
Verdict:
Malware
File Type:
Mach-O universal binary
Threat name:
MacOS.Trojan.Malgent
Status:
Malicious
First seen:
2026-09-09 15:12:36 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
10 of 23 (43.48%)
Threat level:
5/5
Detection(s):
Suspicious file
Malware family:
AtomicStealer
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
zsh
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.