MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AmosStealer


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367
SHA3-384 hash: 090895c71e5fdf8727e790231edf80ed5c52d9cf51781357ccdcf7a8a70de1dc9536095ce2d5b5eee2763a207b99d0fb
SHA1 hash: 0fb6567c83e7d285e6d82e87132a2b81a29f67c4
MD5 hash: 6ef01beda5bf9bc38b921c870145f610
humanhash: artist-stream-black-nevada
File name:updater
Download: download sample
Signature AmosStealer
Create hunting rule
File size:370'944 bytes
First seen:2025-12-25 22:08:10 UTC
Last seen:Never
File type:php macho
MIME type:application/x-mach-binary
ssdeep 6144:+p1D11lFz1f59Ig8UQTovai9xW692E6OPhcJ8+I3OP1D5Ym:+j5brf59Ig8UQ8txW64EPSQk1D+
TLSH T1F9849E0B9F2D9D1AD0C0D07C978E9A63D222F1781722632F3F51469DBE58AE43A1DB17
TrID 82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5)
17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika macho
Reporter BastianHein
Tags:AmosStealer machO

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
CL CL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694db5d101c7b4a8fe55dc0d
Tags:
stealer virus
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
amos base64 stealer
Link:
https://www.filescan.io/uploads/694db5d0a7163552ba04eff0/reports/ee8a4d20-776b-4acc-8393-cc188ec81a4f/overview
Verdict:
Malicious
Labled as:
Trojan[PSW]/MacOS.Amos
Link:
https://www.hybrid-analysis.com/sample/fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367
Verdict:
Malicious
File Type:
macho fat
First seen:
2025-12-25T19:05:00Z UTC
Last seen:
2025-12-26T12:48:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-PSW.OSX.Amos.u
Link:
https://opentip.kaspersky.com/fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
Mach-O universal binary
Link:
https://malprob.io/report/fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367/
Verdict:
Malicious
Threat:
Family.AMOSSTEALER
Link:
https://tip.neiki.dev/file/fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367
Threat name:
MacOS.Trojan.Amos
Create hunting rule
Status:
Malicious
First seen:
2025-12-25 22:08:17 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
6 of 36 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7zykdk75pcw2nygtklyzbh2japeiflo45giaqxeddo6ofv4pmntq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:XCSSET_Strings
Create hunting rule
Author:@is_henderson
Description:Rule based on deob strings - easymode

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AmosStealer

php macho fe70a1abfd78ada6e0d352f1909f4903c882addce990085c831bbce2d78f6367

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3743658/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3743659/
  
URLhaus
https://urlhaus.abuse.ch/url/3743664/

Comments