MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 841f0ccf4e6e782476a0844cc861f7f44d7f321bc232444ef5f306fdba8944eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 841f0ccf4e6e782476a0844cc861f7f44d7f321bc232444ef5f306fdba8944eb |
|---|---|
| SHA3-384 hash: | cede86c1cd8dd223beb4e52b9ec33edbe0f0b6801e8d2d320f5c275b48a98bc5cc985a5f980399535c81edcca5b80a72 |
| SHA1 hash: | bc129334f9462fba7cf9321a318d6dc124a35451 |
| MD5 hash: | 3d000465564399a53dfd52700c028fc7 |
| humanhash: | ceiling-purple-triple-idaho |
| File name: | stage3.macho |
| Download: | download sample |
| File size: | 592'688 bytes |
| First seen: | 2026-09-15 09:23:27 UTC |
| Last seen: | Never |
| File type: |  macho |
| MIME type: | application/x-mach-binary |
| ssdeep | 12288:7H1yTJdQgc42ot3QFIu5b33rT/1oqJG8Uw6owEJu51yTXdQgcY2ot3wFIu5b33r9:7H1y7U9oGmo3bT9oq9le51yZUdo2mo3h |
| TLSH | T18BC402796218BC0EF0AA867C3EAB05E32809AF74605A0F261F15BE753C63D965750F37 |
| TrID | 82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2) |
| Magika | macho |
| Reporter | Anonymous |
| Tags: | chacha20-poly1305 machO macOS stealer universal-binary |
Anonymous
Stage 3, a universal Mach-O (x86_64 + arm64) dropped and executed by stage2.sh. Contains six ChaCha20-Poly1305-encrypted chunks; the ChaCha key is derived via XOR + 93,946 rounds of PBKDF2-HMAC-SHA256 plus HMAC-SHA256 over the binary's own __text section. Decrypts to a compiled, Run-Only AppleScript payload.Intelligence
File Origin
# of uploads :
1
# of downloads :
83
Origin country :
EGVendor Threat Intelligence
No detections
Detection(s):
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
stealer
Verdict:
Malicious
Labled as:
Mac/malicious_confidence_90%
Verdict:
Unknown
File Type:
MachO
First seen:
2026-09-13T15:13:00Z UTC
Last seen:
2026-09-13T15:23:00Z UTC
Hits:
~10
Score:
100%
Verdict:
Malware
File Type:
Mach-O universal binary
Threat name:
MacOS.Infostealer.Generic
Status:
Suspicious
First seen:
2026-09-15 09:24:20 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
3 of 36 (8.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Malware family:
AMOS
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
da50d3c4803cfca814db10be4ef7f0ed2933ebd0bfa1ed52502c5b416f74c64b
macho 841f0ccf4e6e782476a0844cc861f7f44d7f321bc232444ef5f306fdba8944eb
(this sample)
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.