Atomic Stealer

Hunt queries (Shodan, Censys, Fofa, URLScan)

Hunt query sharings are temporarily disabled.

Summary

TL; DR: An emerging macOS infostealer

Type: Information stealer

Targeted Operating Systems: macOS

Interesting characteristics: Fake login prompt

Threat tag: osx.amos

Reporting: https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos 

TTPs

Screenshots

IOCs

• 94.142.138.177:80
• 185.106.93.154:80
• 185.215.113.116:80
• 171.22.28.248:80
• 194.169.175.117:80
• 194.49.94.93:80
• 185.172.128.163:80
• 172.67.177.191:80
• 172.67.177.191:443
• 104.21.17.179:80
• 104.21.17.179:443
• 5.42.65.55:80
• 89.208.105.191:80
• 5.42.65.107:5000
• 5.42.65.55:5000