MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb57da18871de86b3301955ada60d2e5b16f201473ed4c9ccbae202546d71726. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AmosStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	fb57da18871de86b3301955ada60d2e5b16f201473ed4c9ccbae202546d71726
SHA3-384 hash:	2f613f76631e94ca627ca47e384918a6f28796317de1caa52a728f21e119f083dc7c0d0226c706cbbaccb4140f537cfe
SHA1 hash:	d6413dbe668986d1bee6f545e1827fcb6eced4dc
MD5 hash:	bf71e6306b19e896ba95d5ee71b7b982
humanhash:	lemon-kentucky-one-saturn
File name:	fb57da18871de86b3301955ada60d2e5b16f201473ed4c9ccbae202546d71726
Download:	download sample
Signature	AmosStealer Create hunting rule
File size:	363'509 bytes
First seen:	2025-01-20 10:22:59 UTC
Last seen:	Never
File type:
MIME type:	application/zlib
ssdeep	6144:oX9Z8gPFs6hJS1JAZj6PPw6hDSXnVr2ftJOP8g7kP0aSqcGv:w9/ijAy00VrskP0JKv
TLSH	T1E07412F3986C7951CE465DF4963994621C8EFFCFAD6A1453EC2B386828C029931F8573
TrID	97.6% (.DMG) Macintosh Disk image (BZlib compressed) (83000/1/20) 2.3% (.) ZLIB compressed data (best comp.) (2000/1)
Magika	dmg
Reporter	JAMESWT_WT
Tags:	AmosStealer rgueapp-com

Intelligence

File Origin

# of uploads :

# of downloads :

320

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678e2e78e708b6e7a3ad93ef

Tags:

n/a

Verdict:

Unknown

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/678e2416a133e9ca8d0d2b3d/reports/6b441455-1eba-46fa-b765-83a070920244/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fb57da18871de86b3301955ada60d2e5b16f201473ed4c9ccbae202546d71726

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb57da18871de86b3301955ada60d2e5b16f201473ed4c9ccbae202546d71726/

Threat name:

MacOS.Trojan.Amos

Status:

Malicious

First seen:

2025-01-20 10:14:09 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7nl5ugehdxugwmybsvnnuygs4wyw6iauopwuzhglvyqckrwxc4ta._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb57da18871de86b3301955ada60d2e5b16f201473ed4c9ccbae202546d71726

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)