Essential information

Value / Name

1241ad4f8f667b7a733655b3805ab021486cbce0

Confidence

100/100

Revoked

Yes

Valid from

30/01/2024 16:26

Valid until

04/05/2025 17:26

Pattern type

yara

Published

20/12/2025 19:42

Modified

21/12/2025 03:03

Author / Source

AlienVault

Description

Pattern

rule Atomic_Stealer { meta:  author = "Cyble Research and Intelligence Labs"  description = "Detects Atomic_Stealer files"  date = "2024-01-16"  os = "MacOS"   hash = "59060a3cf38453225891c7c9871d867340f95d027c910ede1f14947dda983a19" strings:  $a1 = "FileGrab" ascii nocase  $a2 = "find-generic-password -ga" ascii nocase  $a3 = "Cookies.binarycookies" ascii nocase  $a4 = "5.42.65." ascii nocase  $a5 = "Binance" ascii nocase condition:  uint32(0) == 0xbebafeca and all of them }

Labels / Tags

Labels: amos atomic stealer google chrome grabber macos malware md5 sha1 stealer xehook

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.