In reply to Kyle.

Hi Kyle,

For AMP we got some samples here :

Looking up SHA256: 8A9CD910DE0349A1FD67D535E7AB6815E30544DD77D479A07932ECCB3F56E66E
Disposition: MALICIOUS
Detection Name: Osx.Trojan.Downlite.VRT

Looking up SHA256: 89A6827698BDFF134A2400EE5DB7E4B17256693A27107166EBA973E5B340D8CF
Disposition: MALICIOUS
Detection Name: Osx.Trojan.Downlite.VRT

Looking up SHA256: ED45848D90383A7BDB6FF1F0873EECB7C8396CCA425EE490054CD201E88EC6DA
Disposition: MALICIOUS
Detection Name: Osx.Trojan.VSInstaller.VRT

Looking up SHA256: 1DAF05E66F92B41F52860E95507C3D5E342F3582AF3B26A7D88F817FBC9BBB32
Disposition: MALICIOUS
Detection Name: Osx.Trojan.VSInstallerHelper.VRT

Looking up SHA256: 2C7C5D91C68F82F9095EC2FAFDF712D1EF26612017AC1BBAE9958519C7789BF1
Disposition: MALICIOUS
Detection Name: Osx.Trojan.VSearchAgent.VRT

Looking up SHA256: B04033409421AB84DA8882681ACE5B58AB3771199BBB1141F3C7C63CB71C9862
Disposition: MALICIOUS
Detection Name: Osx.Trojan.VSearchPlugIn.VRT

Looking up SHA256: E7EF2971139BCA0F3B4A0B2014522114FAC9792AA9AE61D3D5E0B89368947F75
Disposition: MALICIOUS
Detection Name: Osx.Trojan.VSearchLoader.VRT

Looking up SHA256: A3150AECD5F12B5A4108EF50044FEDC0C7B6B69B3EA83BF1E151AD5330F8FC8C
Disposition: MALICIOUS
Detection Name: Osx.Adware.Conduit.VRT

Looking up SHA256: E06F4340D890384457EF7370ABFE0D5E9D8E22F621A62DE835D589DCDB873155
Disposition: MALICIOUS
Detection Name: Osx.Adware.Conduit.VRT

Looking up SHA256: D1CA836F1D494F03B931550C722EA92B0A027E92C57484903B86DF686E31F2AE
Disposition: MALICIOUS
Detection Name: Osx.Adware.Conduit.VRT

And here is the SID : [SID] 32117-32120

I hope this helps.

/Armin