MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb78ceba25e1c334e5ee2490385f1ef20f489d50d5065f120076cc5f3486de22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AmosStealer

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	fb78ceba25e1c334e5ee2490385f1ef20f489d50d5065f120076cc5f3486de22
SHA3-384 hash:	23668258e619f376756f53c86b8df104c79d3fd9e153250814c21b959c919f6b71c5efca86f244088c3d2a336e920566
SHA1 hash:	a81b7c56b36ecec466bfa831ade79576a1c8bf61
MD5 hash:	806e3976ba8c71bf6825cddb2f370292
humanhash:	shade-don-berlin-papa
File name:	fb78ceba25e1c334e5ee2490385f1ef20f489d50d5065f120076cc5f3486de22
Download:	download sample
Signature	AmosStealer Create hunting rule
File size:	363'521 bytes
First seen:	2025-01-20 10:22:54 UTC
Last seen:	Never
File type:
MIME type:	application/zlib
ssdeep	6144:prwXjudgwfJPvm6h5SBGXR7zPNy6hvSraoDbeoGSk3PVuI8LStv:5CYBJIUxG8SOtuIaqv
TLSH	T14F7413B399A47E92DD4318FC06A660215C8EFFDF1D9D0D26CD7F2C2A3C9834664B4896
TrID	97.6% (.DMG) Macintosh Disk image (BZlib compressed) (83000/1/20) 2.3% (.) ZLIB compressed data (best comp.) (2000/1)
Magika	dmg
Reporter	JAMESWT_WT
Tags:	AmosStealer rgueapp-com

Intelligence

File Origin

# of uploads :

# of downloads :

215

Origin country :

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678e2e76e708b6e7a3ad93e4

Tags:

n/a

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

amos

Link:

https://www.filescan.io/uploads/678e24152d219e36112b3ded/reports/1912fe45-5d21-4860-a33f-22885d3b508f/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fb78ceba25e1c334e5ee2490385f1ef20f489d50d5065f120076cc5f3486de22

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb78ceba25e1c334e5ee2490385f1ef20f489d50d5065f120076cc5f3486de22/

Threat name:

MacOS.Trojan.Amos

Status:

Malicious

First seen:

2025-01-20 10:14:12 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7n4m5orf4hbtjzpoesidqxy66ihurhkq2udf6eqao3gf6neg3yra._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fb78ceba25e1c334e5ee2490385f1ef20f489d50d5065f120076cc5f3486de22

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)