🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://loop-lumen.com/zxc/app.zip.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1906301
IOC: https://loop-lumen.com/zxc/app.zip
IOC Type :url
Threat Type :payload_delivery
Malware: AMOS
Malware alias:Atomic macOS Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-09-09 15:58:25 UTC
Last seen:never
UUID:1b65d06d-ac66-11f1-b569-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:Amos ClickFix macOS stealer wallet-hijack
Reference: https://bazaar.abuse.ch/sample/8f12396cfb1ac4d52b3c0fad997b2cf83839bc464cfa43e43959239a3016d287/

Avatar
Anonymous
Trojanised wallet application replacements downloaded by the AMOS ClickFix stage 5 AppleScript. app.zip replaces /Applications/Ledger Wallet.app, apptwo.zip replaces /Applications/Trezor Suite.app and appex.zip replaces /Applications/Exodus.app. Each handler checks the target app is installed, downloads the archive, verifies it starts with PK and exceeds a size floor, kills the process, rm -rf's the bundle (escalating with sudo -S and the phished account password on failure), then unpacks the replacement into /Applications with ditto -x -k and chmods it executable. A marker file ~/.logged containing user100 is written first. These are second-stage downloads performed by the malware, not victim-facing delivery URLs, so they may not serve a payload to an unauthenticated fetch.