MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 67fc8fa7d9f844275afbbdf7fe3949074f3abb94319a774c0dcc9d5dfd9b1845. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	67fc8fa7d9f844275afbbdf7fe3949074f3abb94319a774c0dcc9d5dfd9b1845
SHA3-384 hash:	cf7ddd5e9b3d24af76c99ba484b31cfa495d2515a8c064df86ae7b0a4a029bd302b3ada6c9076b609697d1dde1a4b091
SHA1 hash:	441070637c5c9b69a58e771d61e2e4b0d7ad1090
MD5 hash:	59057a6e1d35a33e3224ccc876533477
humanhash:	washington-illinois-skylark-edward
File name:	Tutebu
Download:	download sample
File size:	790'128 bytes
First seen:	2026-10-27 11:58:35 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	12288:2hgCWZbPN4HDcYCpPctul8+zGUQ+acanBzD3lgUck5rQRBxwCK4:2hG+jc3OlgKewC
TLSH	T122F43A177229A921ED5B323DBB8B3A7BEC50F93D7165F89E590101348FE22349214B9F
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	BlinkzSec

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.MacOS.Stealer-FS.11229341.UNOFFICIAL

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ae0921e3a56bbccb37beb16

Tags:

stealer trojan virus

Verdict:

Malicious

Labled as:

Mac/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/67fc8fa7d9f844275afbbdf7fe3949074f3abb94319a774c0dcc9d5dfd9b1845

Verdict:

Malicious

File Type:

macho fat

First seen:

2026-10-20T09:34:00Z UTC

Last seen:

2026-10-28T19:02:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/67fc8fa7d9f844275afbbdf7fe3949074f3abb94319a774c0dcc9d5dfd9b1845/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/67fc8fa7d9f844275afbbdf7fe3949074f3abb94319a774c0dcc9d5dfd9b1845

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/67fc8fa7d9f844275afbbdf7fe3949074f3abb94319a774c0dcc9d5dfd9b1845/

Threat name:

MacOS.Trojan.AmosStealer

Status:

Malicious

First seen:

2026-10-19 00:33:41 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 38 (47.37%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=m76i7j6z7bccowx3xx374okja5htvo4uggnhotanzsov37m3dbcq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/67fc8fa7d9f844275afbbdf7fe3949074f3abb94319a774c0dcc9d5dfd9b1845

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	Gibberdrop_AMOS_ConfigRolXor Create hunting rule
Description:	AMOS macOS stealer (mainline panel builds) - rolling-key XOR decrypt loop of the embedded __data config (key rotated right by 1 per byte), arm64 and x86_64