MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b95ea805469383b5a419c5043de45bb2b13f36b3a513f98bd608b3f7294f064f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b95ea805469383b5a419c5043de45bb2b13f36b3a513f98bd608b3f7294f064f
SHA3-384 hash:	995e20b758d525e0b9748ae003ae7b6200267ccafbe8d6b05dd225f472e6c384fe893a17708e3e85efbecab1b91c0ebf
SHA1 hash:	649b5835d1085dfd813e0c9be8486c57ebb8f176
MD5 hash:	6311d6c827d5e1d932b6991380204f63
humanhash:	oven-four-south-quebec
File name:	stage4_buildB.macho
Download:	download sample
Signature	AMOS Alert Create hunting rule
File size:	330'704 bytes
First seen:	2026-09-09 14:51:03 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	6144:vbeG6YCzkvSuC3U30Hb2zJTd8imdgqkvSOCHU30HL2zJTd8i:yl5V33SR9x8imKqVXHSp9x8i
TLSH	T10B64F116F70C6560C47EE13C3EA76F426624B2610B7859AD2318BB041D9D29BF72FE93
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	2opremio
Tags:	AMOS ClickFix machO macOS packed

2opremio

Sibling build of 4903c40fbdb96cf39f35ed592a886a39d230564b26dd80aef3fa6c58bc501551. Identifier setup-82a8d5df0f36c6ea0fefd4c816ec8a8d55563b5f, CDHash d50bc1d32e13e4c4eeb162398e490b1e20f055ed. Same packer and same campaign.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

368

Origin country :

ES

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac914f752869b439d0ad814

Tags:

malware

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aa17762d25f63123d4e9dcf/reports/fd06042c-c7da-4b49-8b8b-abf61ca3918d/overview

Hybrid Analysis Trojan_MacOS_AmosStealer_DC_MTB

Verdict:

Malicious

Labled as:

Trojan_MacOS_AmosStealer_DC_MTB

Link:

https://www.hybrid-analysis.com/sample/b95ea805469383b5a419c5043de45bb2b13f36b3a513f98bd608b3f7294f064f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

macho fat

First seen:

2026-09-08T12:00:00Z UTC

Last seen:

2026-09-10T21:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b95ea805469383b5a419c5043de45bb2b13f36b3a513f98bd608b3f7294f064f/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/b95ea805469383b5a419c5043de45bb2b13f36b3a513f98bd608b3f7294f064f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b95ea805469383b5a419c5043de45bb2b13f36b3a513f98bd608b3f7294f064f/

ReversingLabs TitaniumCloud MacOS.Trojan.Malgent

Threat name:

MacOS.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-08 23:51:19 UTC

File Type:

Binary (Archive)

Extracted files:

2

AV detection:

10 of 24 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xfpkqbkgsob3ljazyucd3zc3wkyt6nvtuuj7tc6wbcz7okkpazhq._file

VMRay AtomicStealer

Malware family:

AtomicStealer

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b95ea8054693/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b95ea805469383b5a419c5043de45bb2b13f36b3a513f98bd608b3f7294f064f