MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e17ded9dacf5bb1c1a3e84918a5ef318f48ef86d766ee2d7565e0915ff5adc90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e17ded9dacf5bb1c1a3e84918a5ef318f48ef86d766ee2d7565e0915ff5adc90
SHA3-384 hash:	f18905d16a94c9a2e2acd1dfc64a702dffd8f15503f38af713020f9cb753fec24f399cc888434a402cee9957be21f455
SHA1 hash:	f8020a148e3f8a3e216dec09d6e2883909789d8d
MD5 hash:	21d96fa88bb46a447693acfd4a55074a
humanhash:	batman-autumn-seven-yellow
File name:	update
Download:	download sample
Signature	AmosStealer Alert Create hunting rule
File size:	479'320 bytes
First seen:	2025-10-09 15:45:23 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	6144:IeO8nTufG7tzhO4xCXm5uCRW48LJethE9kfO8nTufG7tzhO4xCXm5uCRW48LJet0:51ufG7t4NBhLJe51ufG7t4NBhLJem
TLSH	T151A4122BBB972878C05EA47692EF4E55123CFEF10D649BA31831F0D84BC36EA51D4971
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	sasper
Tags:	AMOS AmosStealer machO nerwica.org

Saszper

Hosted on nerwica.org

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

39

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e7d92d8b7b147cc4b637a1

Tags:

n/a

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68e7f6e75a3bccf09ebfa25e/reports/1a1f34d8-2edf-4de1-80d4-b183491fa918/overview

Hybrid Analysis Mac/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Mac/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/e17ded9dacf5bb1c1a3e84918a5ef318f48ef86d766ee2d7565e0915ff5adc90

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

macho fat

Link:

https://opentip.kaspersky.com/e17ded9dacf5bb1c1a3e84918a5ef318f48ef86d766ee2d7565e0915ff5adc90/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/e17ded9dacf5bb1c1a3e84918a5ef318f48ef86d766ee2d7565e0915ff5adc90

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e17ded9dacf5bb1c1a3e84918a5ef318f48ef86d766ee2d7565e0915ff5adc90/

ReversingLabs TitaniumCloud MacOS.Trojan.Amos

Threat name:

MacOS.Trojan.Amos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-09 18:18:19 UTC

File Type:

Binary (Archive)

Extracted files:

2

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4f663hnm6w5rygr6qsiyuxxtdd2i56dnozxofv2wlyerl7223sia._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e17ded9dacf5bb1c1a3e84918a5ef318f48ef86d766ee2d7565e0915ff5adc90