MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e5bcbe70bb0b4a19371259befc48de05f18001630d9ea803b17088cd7b1e292f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
AMOS
Vendor detections: 9
| SHA256 hash: | e5bcbe70bb0b4a19371259befc48de05f18001630d9ea803b17088cd7b1e292f |
|---|---|
| SHA3-384 hash: | 720ceb1bc3fc1b753eb8256820a7ef03d12130c89490c00542d210414f3c5d312c8a17460a235caa01ae8cb43964d351 |
| SHA1 hash: | 7953d49b7f962c4a6a2b1944bba38608f54e6633 |
| MD5 hash: | e774b725906d0047bb36df19d0d7ca11 |
| humanhash: | lactose-pasta-comet-uniform |
| File name: | macho_e5bcbe70bb0b.bin |
| Download: | download sample |
| Signature | AMOS |
| File size: | 969'648 bytes |
| First seen: | 2026-09-27 14:28:20 UTC |
| Last seen: | Never |
| File type: |  macho |
| MIME type: | application/x-mach-binary |
| ssdeep | 24576:aXIzHBRWs35kiYX0FnooB3IQBFeyo9u7b:aXOyU5kWnUeFeeb |
| TLSH | T15B25F101CE6694A6F6CCDA3427278A379F396130888912DB53635B689D323E3F15736F |
| TrID | 82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2) |
| Magika | macho |
| Reporter |  c4ffeine |
| Tags: | AMOS ClickFix Foxveil Loader Mach-O machO macOS |
c4ffeine
Foxveil 'quill' build Mach-O, the TWENTY-EIGHTH payload served from this one unchanged URL (fat x86_64+arm64, 969,648 B), fetched via Tor 2026-09-27 11:53:40 UTC, origin build time 11:22:33, 1 hour 12 minutes after the previous build d70183a3214c07c3f4235404afeddeba8db9783bc73e8e6f813c7d8e7ce1bdc1 (built 10:10:09). Same loader family as the previous build by function-level CFG match (TLSH of __text 18, inside the 11 to 128 band measured between builds of this family) and a payload table of 194,636 B plaintext against 192,656 B, but the wrapper moved with this build: The loader was relinked without libc++ and with CoreServices, dropped its padding segment and rotated its PBKDF2 count, filler items, tokens and temp file name. The AppleScript is unchanged (47 of 47 handlers, similarity 0.97, same host and path set) but the constructor config moves telemetry to a new IP, 152.42.143.45, outside the known set. Not executed. VirusTotal: https://www.virustotal.com/gui/file/e5bcbe70bb0b4a19371259befc48de05f18001630d9ea803b17088cd7b1e292f Hybrid Analysis: https://hybrid-analysis.com/sample/e5bcbe70bb0b4a19371259befc48de05f18001630d9ea803b17088cd7b1e292fIntelligence
File Origin
# of uploads :
1
# of downloads :
317
Origin country :
USVendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
81.4%
Tags:
virus
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Tags:
masquerade
Verdict:
Malicious
Labled as:
Mac/malicious_confidence_60%
Verdict:
Malicious
File Type:
macho fat
First seen:
2026-09-28T18:41:00Z UTC
Last seen:
2026-09-28T19:08:00Z UTC
Hits:
~10
Score:
100%
Verdict:
Malware
File Type:
Mach-O universal binary
Threat name:
MacOS.Trojan.Generic
Status:
Suspicious
First seen:
2026-09-27 14:29:18 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
4 of 24 (16.67%)
Threat level:
5/5
Detection(s):
Suspicious file
Malware family:
AtomicStealer
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Amos
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Link
Link
Link
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.