MalwareBazaar Database

This page shows some basic information the YARA rule Foxveil_Stage1_Zsh_ConstKey_AesCtr including corresponding malware samples.

Database Entry

YARA Rule:Foxveil_Stage1_Zsh_ConstKey_AesCtr
Create hunting rule
Description:Foxveil ClickFix stage-1 zsh dropper: hex blobs -> md5(constant _kb) -> openssl AES-128-CTR IV 0 -> gunzip -> zsh, behind a decoy maintenance script
Firstseen:2026-09-18 20:28:00 UTC
Lastseen:2026-10-01 21:23:17 UTC
Sightings:4

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter