🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 81e34b0ec6928234d0a24f9b1634d1e2201fe0fca38bf048229d750ba35f64ca.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1973575
IOC: 81e34b0ec6928234d0a24f9b1634d1e2201fe0fca38bf048229d750ba35f64ca
IOC Type :sha256_hash
Threat Type :payload
Malware: AMOS
Malware alias:Atomic macOS Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-10-18 19:25:19 UTC
Last seen:never
UUID:a80f2ff5-cb29-11f1-bd13-42010aa4000a
Reporter c4ffeine
Reward 5 credits from ThreatFox
Tags:Amos ClickFix Foxveil macOS
Reference: https://www.virustotal.com/gui/file/81e34b0ec6928234d0a24f9b1634d1e2201fe0fca38bf048229d750ba35f64ca

Avatar
c4ffeine
Foxveil/AMOS reflective loader Mach-O (1,758,160 B), first seen on YARAify 2026-10-18 18:24 UTC (01pemlfd, no source URL). Statically opened: its encrypted payload decodes to the same AMOS AppleScript stealer as the earlier 01pemlfd builds (same handler count, config injected at run time, no host in the file). Not executed. VirusTotal: https://www.virustotal.com/gui/file/81e34b0ec6928234d0a24f9b1634d1e2201fe0fca38bf048229d750ba35f64ca Hybrid Analysis: https://hybrid-analysis.com/sample/81e34b0ec6928234d0a24f9b1634d1e2201fe0fca38bf048229d750ba35f64ca