MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd0cd32edfe9b4f68dcc2fddb8f27c6102e9a9c8b90c5def07ac8e62b2a75303. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	fd0cd32edfe9b4f68dcc2fddb8f27c6102e9a9c8b90c5def07ac8e62b2a75303
SHA3-384 hash:	3b7fef488caee2b7314ad1a923042240435f2061db849af793cfef0f2043120a40eb54b63128770f93470b6b1a3d56e3
SHA1 hash:	f168e0a230e81e30596848b5f3af47b5d130a9c5
MD5 hash:	b6000eb45cc980f5fba975a5ccc9f909
humanhash:	leopard-two-mississippi-alanine
File name:	macho_fd0cd32edfe9.bin
Download:	download sample
File size:	723'072 bytes
First seen:	2026-09-27 03:29:14 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	12288:tU7wAcpxXAIIETE1UWLwJrr1nuwyyPUcyvmByHaRR1L+:tU7RyAOTtQvPaRW
TLSH	T112F42AAB527AA4D4EC4732747B8A3BF7EE40B47663F5E4A9AA42513448F3374913021F
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	c4ffeine
Tags:	AMOS ClickFix Mach-O machO macOS stealer

c4ffeine

AMOS stealer Mach-O (723,072 B) served from the bare IP 192.162.199.249 (AS214351 FEMO IT Solutions, DE) as the ClickFix stage-2 at http://192.162.199.249/ujnyyodzjazt2491. The stage-1 at http://192.162.199.249/cr2nfs6c is a 142 B shell one-liner that downloads that path into TMPDIR, strips the quarantine attribute and runs it (stage-1 sha256 8f245d981061827ea694497d1c9045a3415104b25ce316d531706a1fd886726f). Both fetched via Tor 2026-09-27 03:25 UTC; the body is identical for a curl and a Safari User-Agent. The host has served per-victim random paths of this shape since August 2026: the __text section of this build is byte-identical to the build 0f808ec0e7d9fb413f44331ba5fc6a23ca282363f244062f0acaa418e55b2ec8 (same size, same per-function CFG hash, TLSH distance 0), so this is the same AMOS build with different embedded data. Not executed, not unpacked. VirusTotal: https://www.virustotal.com/gui/file/fd0cd32edfe9b4f68dcc2fddb8f27c6102e9a9c8b90c5def07ac8e62b2a75303 Hybrid Analysis: https://hybrid-analysis.com/sample/fd0cd32edfe9b4f68dcc2fddb8f27c6102e9a9c8b90c5def07ac8e62b2a75303

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Mac.PWS.Amos.256.30033.31563.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

masquerade stealer

Link:

https://www.filescan.io/uploads/6ab88dcc637c84850a8399bb/reports/04e390bd-7c91-40e8-8146-604bb69ccf6e/overview

Verdict:

Malicious

Labled as:

Trojan.MAC.Stealer

Link:

https://www.hybrid-analysis.com/sample/fd0cd32edfe9b4f68dcc2fddb8f27c6102e9a9c8b90c5def07ac8e62b2a75303

Score:

100%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/fd0cd32edfe9b4f68dcc2fddb8f27c6102e9a9c8b90c5def07ac8e62b2a75303

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd0cd32edfe9b4f68dcc2fddb8f27c6102e9a9c8b90c5def07ac8e62b2a75303/

Threat name:

MacOS.Trojan.AmosStealer

Status:

Malicious

First seen:

2026-09-27 03:30:27 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ugnglw75g2pndomf7o3r4t4mebotkoixegf33yhvshgfmvhkmbq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Amos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd0cd32edfe9b4f68dcc2fddb8f27c6102e9a9c8b90c5def07ac8e62b2a75303

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries