🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash b6d67f2e99a22a3ce5b536b9718d71fef2d2f8cdf2f427e3bd193b318c814e18.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:2005948
IOC: b6d67f2e99a22a3ce5b536b9718d71fef2d2f8cdf2f427e3bd193b318c814e18
IOC Type :sha256_hash
Threat Type :payload
Malware: AMOS
Malware alias:Atomic macOS Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-10-31 06:25:16 UTC
Last seen:never
UUID:d67e9a0b-d4f3-11f1-a74e-42010aa4000a
Reporter c4ffeine
Reward 5 credits from ThreatFox
Tags:Amos ClickFix Foxveil macOS
Reference: https://bazaar.abuse.ch/sample/b6d67f2e99a22a3ce5b536b9718d71fef2d2f8cdf2f427e3bd193b318c814e18/

Avatar
c4ffeine
Foxveil/AMOS reflective loader Mach-O, quill-family build first seen on YARAify 2026-10-29 00:35 UTC (01pemlfd). Loader code and payload size match the previous build of the series and the payload key was recovered statically. Not executed. MalwareBazaar: https://bazaar.abuse.ch/sample/b6d67f2e99a22a3ce5b536b9718d71fef2d2f8cdf2f427e3bd193b318c814e18/