TF-1931074
high
📛 Threat Title
AMOS: SHA256 hash of a malware sample (payload) a18aa476ad595ad3567df4fa98f3a615a3c6b6ac450c8dc3d2e95ce98c7634a7
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: AMOS (aliases: Atomic macOS Stealer). Confidence: 100. First seen: 2026-09-23 21:11:40 UTC. Reporter: c4ffeine. Tags: Amos, cc2, ClickFix, Foxveil, macOS.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
a18aa476ad595ad3567df4fa98f3a615a3c6b6ac450c8dc3d2e95ce98c7634a7
IOC database
- Type
- hash_sha256
- Value
a18aa476ad595ad3567df4fa98f3a615a3c6b6ac450c8dc3d2e95ce98c7634a7- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA256 hash of a malware sample (payload) attributed to AMOS
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: AMOS (aliases: Atomic macOS Stealer). Confidence: 100. First seen: 2026-09-23 21:11:40 UTC. Reporter: c4ffeine. Tags: Amos, cc2, ClickFix, Foxveil, macOS.
- External reference ThreatFox IOCs
Remediations (10)
-
web:bazaar.abuse.ch
MalwareBazaar MalwareBazaar is a platform from abuse.ch and Spamhaus, dedicated to sharing malware samples with the infosec community, antivirus vendors, and threat intelligence providers. Upload malware samples and explore the database for valuable intelligence. Set alerts to track newly observed malware , use APIs to seamlessly push or pull signals, and automate bulk queries. With this ...
-
web:bazaar.abuse.ch
Using the form below, you can search for malware samples by a hash (MD5, SHA256 , SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database
-
web:bazaar.abuse.ch
A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as AMOS .
-
web:bazaar.abuse.ch
Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with AMOS .
-
web:cipherssecurity.com
Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.
-
web:github.com
infected - password for all archives. 🔑 SHA256 - is hash of file in archive. ⌗ Virus/ Malware - software to infect, damage, or erase file/s, network, wireless network, server/s. (？) ️
-
web:github.com
A public repository that provides regularly updated lists of malicious file hashes (MD5, SHA-1, SHA-256 ) and related metadata for use in firewall, gateway endpoint or other security device blocking...
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:ismalicious.com
Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.
-
web:www.team-cymru.com
The Malware Hash Registry is a programmatic hash validation service operated by TeamCymru. Submit an MD5, SHA-1, or SHA-256 hash via HTTPS, DNS, or WHOIS and get back a near-real-time response showing the last time the sample was seen and the percentage of 30+ antivirus databases that flagged it.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.