Atomic macOS Stealer (AMOS): Mach-O universal binary with XOR-obfuscated behavioral layer and dual HTTP C2 endpoints

{
  "iim_version": "1.1",
  "chain_id": "medium.2026.atomic-macos-stealer-amos-http-c2",
  "title": "Atomic macOS Stealer (AMOS): Mach-O universal binary with XOR-obfuscated behavioral layer and dual HTTP C2 endpoints",
  "description": "IIM chain built from an original reverse-engineering report published on 2026-05-31. The report analyzes a Mach-O universal binary associated with Atomic macOS Stealer (AMOS). The sample uses a rolling XOR routine keyed by 7M43mJx9I0GwjslSA2oKSgkqsUo to hide runtime strings, decrypts AppleScript- and shell-based operational commands, performs theft of browser, wallet, keychain, Telegram, Discord, FileZilla, Steam, Notes, and shell-history data, and sends stolen data over plain HTTP to 85.217.222.185 using /static.php and /index.php endpoints. No trustworthy initial-delivery URL, package source, or landing page is published, so the chain starts at the analyzed sample rather than inventing a pre-delivery stage.",
  "actor_id": "unknown",
  "observed_at": "2026-05-31T00:00:00Z",
  "confidence": "confirmed",
  "needs_review": false,
  "import_source": "manual-osint-report-to-iim-conversion",
  "x_source": {
    "title": "Reverse Engineering Atomic macOS Stealer (AMOS): From XOR Cipher to C2 Server",
    "publisher": "Medium",
    "author": "Chandra Kant Bauri",
    "url": "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211",
    "published_at": "2026-05-31",
    "accessed_at": "2026-05-31T19:00:18.390040+00:00",
    "source_type": "original malware reverse-engineering report",
    "source_policy": "Only the original Medium analysis was used. No secondary summaries were used for chain content."
  },
  "x_source_title": "Atomic macOS Stealer (AMOS): Mach-O universal binary with XOR-obfuscated behavioral layer and dual HTTP C2 endpoints",
  "x_source_url": "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211",
  "x_resource_links_verified": [
    {
      "url": "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211",
      "status": "opened via web retrieval",
      "verified_at": "2026-05-31T19:00:18.390040+00:00",
      "notes": "Verified article title, publication timing, sample hashes, XOR key, dual HTTP C2 endpoints, theft scope, and AppleScript/evasion behavior."
    }
  ],
  "x_iocs": {
    "sha256": [
      "ce6dc065752cb46437ce6a200e29d5dbd96473daa72dcce07aa493b821a99ba9"
    ],
    "md5": [
      "cad2cd91df26c92ecf246c01276f6c2f"
    ],
    "ips": [
      "85.217.222.185"
    ],
    "urls": [
      "http://85.217.222.185/static.php",
      "http://85.217.222.185/index.php"
    ],
    "files": [
      "Mach-O universal binary"
    ],
    "strings": [
      "7M43mJx9I0GwjslSA2oKSgkqsUo",
      "hy_AM;be_BY;kk_KZ;ru_RU;uk_UA"
    ]
  },
  "x_limitations": [
    "The report provides no confirmed initial delivery URL, fake website, package name, or package repository path. The chain therefore starts at the analyzed sample file rather than inventing a pre-delivery node.",
    "The report mentions developers and unofficial Homebrew-package risk context, but does not publish a concrete malicious Homebrew formula, cask, or package URL. Those are intentionally not modeled.",
    "The report confirms two HTTP C2 endpoints on 85.217.222.185. It does not differentiate one endpoint as a resolver and the other as a final panel, so both are modeled conservatively as c2 endpoints.",
    "Persistence via LaunchAgents is hinted in the article context but not described with a concrete file path or plist name in the published body. No LaunchAgent entity is therefore invented."
  ],
  "entities": [
    {
      "id": "e001",
      "type": "file",
      "value": "Atomic macOS Stealer (AMOS) Mach-O universal binary / ce6dc065752cb46437ce6a200e29d5dbd96473daa72dcce07aa493b821a99ba9",
      "observed_at": "2026-05-31T00:00:00Z",
      "source": "Medium: Reverse Engineering Atomic macOS Stealer (AMOS): From XOR Cipher to C2 Server (2026-05-31)",
      "evidence": [
        "The article identifies the sample as a Mach-O universal binary sized 361.53 KB.",
        "The report publishes SHA-256 ce6dc065752cb46437ce6a200e29d5dbd96473daa72dcce07aa493b821a99ba9 and MD5 cad2cd91df26c92ecf246c01276f6c2f."
      ],
      "x_reference_url": "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211",
      "x_sha256": "ce6dc065752cb46437ce6a200e29d5dbd96473daa72dcce07aa493b821a99ba9",
      "x_md5": "cad2cd91df26c92ecf246c01276f6c2f",
      "x_architectures": [
        "x86_64",
        "arm64"
      ],
      "x_chain_stage": "analyzed_sample"
    },
    {
      "id": "e002",
      "type": "file",
      "value": "XOR-obfuscated AMOS behavioral/config layer using key 7M43mJx9I0GwjslSA2oKSgkqsUo",
      "observed_at": "2026-05-31T00:00:00Z",
      "source": "Medium: Reverse Engineering Atomic macOS Stealer (AMOS): From XOR Cipher to C2 Server (2026-05-31)",
      "evidence": [
        "The report shows the decryption routine XORing encrypted bytes against the 27-byte key 7M43mJx9I0GwjslSA2oKSgkqsUo.",
        "The analysis states the key is referenced across 21 locations and hides commands, file paths, and URLs."
      ],
      "x_reference_url": "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211",
      "x_xor_key": "7M43mJx9I0GwjslSA2oKSgkqsUo",
      "x_chain_stage": "internal_string_decryption"
    },
    {
      "id": "e003",
      "type": "file",
      "value": "AMOS collection and evasion runtime (AppleScript Finder move/delete, xattr quarantine removal, osascript mute, bash self-delete)",
      "observed_at": "2026-05-31T00:00:00Z",
      "source": "Medium: Reverse Engineering Atomic macOS Stealer (AMOS): From XOR Cipher to C2 Server (2026-05-31)",
      "evidence": [
        "The report decrypts AppleScript commands that move and delete files through Finder using osascript.",
        "The report documents quarantine removal with xattr, delayed self-deletion through bash, audio muting through osascript, and collection of browser, wallet, keychain, Telegram, Discord, Steam, FileZilla, Notes, and shell-history data."
      ],
      "x_reference_url": "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211",
      "x_behavioral_commands": [
        "osascript Finder move command template",
        "osascript Finder delete command template",
        "xattr -d com.apple.quarantine \"%s\"",
        "open -a /bin/bash - args -c \"sleep 3; rm -rf '%s'\"",
        "osascript -e 'set volume output muted true'"
      ],
      "x_cis_locale_exclusion": "hy_AM;be_BY;kk_KZ;ru_RU;uk_UA",
      "x_chain_stage": "runtime_collection_and_exfil"
    },
    {
      "id": "e004",
      "type": "url",
      "value": "http://85.217.222.185/static.php",
      "observed_at": "2026-05-31T00:00:00Z",
      "source": "Medium: Reverse Engineering Atomic macOS Stealer (AMOS): From XOR Cipher to C2 Server (2026-05-31)",
      "evidence": [
        "The report states that decrypting a constant yields http://85.217.222.185/static.php.",
        "The article describes this endpoint as a command-and-control endpoint receiving stolen data."
      ],
      "x_reference_url": "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211",
      "x_ip": "85.217.222.185",
      "x_transport": "HTTP",
      "x_chain_stage": "c2_endpoint"
    },
    {
      "id": "e005",
      "type": "url",
      "value": "http://85.217.222.185/index.php",
      "observed_at": "2026-05-31T00:00:00Z",
      "source": "Medium: Reverse Engineering Atomic macOS Stealer (AMOS): From XOR Cipher to C2 Server (2026-05-31)",
      "evidence": [
        "The report states that a second endpoint extracted from decrypted strings is http://85.217.222.185/index.php.",
        "The article groups this endpoint with the same live C2 server infrastructure on 85.217.222.185."
      ],
      "x_reference_url": "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211",
      "x_ip": "85.217.222.185",
      "x_transport": "HTTP",
      "x_chain_stage": "c2_endpoint"
    }
  ],
  "chain": [
    {
      "entity_id": "e001",
      "role": "entry",
      "techniques": [],
      "role_confidence": "confirmed",
      "technique_confidence": "confirmed",
      "needs_review": false
    },
    {
      "entity_id": "e002",
      "role": "staging",
      "techniques": [],
      "role_confidence": "confirmed",
      "technique_confidence": "confirmed",
      "needs_review": false
    },
    {
      "entity_id": "e003",
      "role": "payload",
      "techniques": [],
      "role_confidence": "confirmed",
      "technique_confidence": "confirmed",
      "needs_review": false
    },
    {
      "entity_id": "e004",
      "role": "c2",
      "techniques": [],
      "role_confidence": "confirmed",
      "technique_confidence": "confirmed",
      "needs_review": false
    },
    {
      "entity_id": "e005",
      "role": "c2",
      "techniques": [],
      "role_confidence": "confirmed",
      "technique_confidence": "confirmed",
      "needs_review": false
    }
  ],
  "relations": [
    {
      "from": "e001",
      "to": "e002",
      "type": "references",
      "sequence_order": 1,
      "observed_at": "2026-05-31T00:00:00Z",
      "confidence": "confirmed",
      "x_evidence": [
        "The analyzed Mach-O sample contains and uses the XOR-obfuscated string layer.",
        "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211"
      ]
    },
    {
      "from": "e002",
      "to": "e003",
      "type": "execute",
      "sequence_order": 2,
      "observed_at": "2026-05-31T00:00:00Z",
      "confidence": "confirmed",
      "x_evidence": [
        "The decrypted strings reveal the operational AppleScript and shell commands used by the AMOS runtime.",
        "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211"
      ]
    },
    {
      "from": "e003",
      "to": "e004",
      "type": "connect",
      "sequence_order": 3,
      "observed_at": "2026-05-31T00:00:00Z",
      "confidence": "confirmed",
      "x_evidence": [
        "The article identifies static.php on 85.217.222.185 as an active C2 endpoint receiving stolen data.",
        "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211"
      ]
    },
    {
      "from": "e003",
      "to": "e005",
      "type": "connect",
      "sequence_order": 4,
      "observed_at": "2026-05-31T00:00:00Z",
      "confidence": "confirmed",
      "x_evidence": [
        "The article identifies index.php on 85.217.222.185 as a second endpoint extracted from the same AMOS binary.",
        "https://medium.com/%40ckant/reverse-engineering-atomic-macos-stealer-amos-from-xor-cipher-to-c2-server-355ef51b1211"
      ]
    }
  ],
  "attack_annotations": [
    {
      "technique_id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion",
      "comment": "Strings are XOR-obfuscated and decrypted at runtime."
    },
    {
      "technique_id": "T1059.002",
      "name": "Command and Scripting Interpreter: AppleScript",
      "tactic": "Execution",
      "comment": "AMOS uses osascript/Finder AppleScript templates for file move and delete operations."
    },
    {
      "technique_id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control",
      "comment": "The sample communicates over plain HTTP with two published endpoints on 85.217.222.185."
    },
    {
      "technique_id": "T1555",
      "name": "Credentials from Password Stores",
      "tactic": "Credential Access",
      "comment": "The report states the stealer targets browser data and Apple Keychain."
    },
    {
      "technique_id": "T1005",
      "name": "Data from Local System",
      "tactic": "Collection",
      "comment": "The report states the sample collects browser data, wallets, Notes, FileZilla data, Telegram, Discord, Steam, and shell history."
    }
  ]
}