Threat Actor Selling New Atomic macOS (AMOS) Stealer on Telegram
Tags
maec-delivery-vectors: Watering Hole
attack-pattern: Data Model Credentials - T1589.001 Credentials From Web Browsers - T1555.003 Credentials From Web Browsers - T1503 File And Directory Discovery - T1420 Hardware - T1592.001 Keychain - T1634.001 Keychain - T1555.001 Keychain - T1579 Malicious File - T1204.002 Malware - T1587.001 Malware - T1588.001 Multi-Factor Authentication - T1556.006 Phishing - T1660 Phishing - T1566 Private Keys - T1552.004 Server - T1583.004 Server - T1584.004 Software - T1592.002 Standard Encoding - T1132.001 Tool - T1588.002 Vulnerabilities - T1588.006 Browser Extensions - T1176 Brute Force - T1110 Data Encoding - T1132 Exfiltration Over Command And Control Channel - T1041 File And Directory Discovery - T1083 Keychain - T1142 Private Keys - T1145 User Execution - T1204 User Execution
Show in Graph
Common Information
Type Value
UUID bde26e4c-2812-4153-8a03-399533d94238
Fingerprint ac9478522ef2b2e9
Analysis status DONE
Considered CTI value 2
Text language
Published April 26, 2023, midnight
Added to db Oct. 24, 2023, 1:23 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline Threat Actor Selling New Atomic macOS (AMOS) Stealer on Telegram
Title Threat Actor Selling New Atomic macOS (AMOS) Stealer on Telegram
Detected Hints/Tags/Attributes 69/2/15
Source URLs
Redirection Url
Details Redirection https://blog.cyble.com/2023/04/26/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/
Details Source https://cyble.com/blog/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/
URL Provider
Details Provider Source level domain
Details cyble.com cyble.com
Details cyble.com blog.cyble.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 30 ✔ — https://blog.cyble.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details sha256 2 
15f39e53a2b4fa01f2c39ad29c7fe4c2fef6f24eff6fa46b8e77add58e7ac709
Details MITRE ATT&CK Techniques 365 
T1204.002
Details MITRE ATT&CK Techniques 125 
T1110
Details MITRE ATT&CK Techniques 8 
T1555.001
Details MITRE ATT&CK Techniques 125 
T1555.003
Details MITRE ATT&CK Techniques 585 
T1083
Details MITRE ATT&CK Techniques 99 
T1132.001
Details MITRE ATT&CK Techniques 422 
T1041
Details Url 2 
http://amos-malware.ru/sendlog
Details Domain 2 
setup.app
Details Domain 3 
application.app
Details Domain 5 
amos-malware.ru
Details File 8 
setup.dmg
Details md5 1 
5e0226adbe5d85852a6d0b1ce90b2308
Details sha1 1 
0a87b12b2d12526c8ba287f0fb0b2f7b7e23ab4a