MalwareBazaar Database

This page shows some basic information the YARA rule Foxveil_Stage1_Zsh_ConstKey_AesCtr_B including corresponding malware samples.

Database Entry

YARA Rule:Foxveil_Stage1_Zsh_ConstKey_AesCtr_B
Create hunting rule
Description:Foxveil ClickFix stage-1 zsh dropper, 2026-10-21 generator: any blob-array name and a _kb expression starting on a plain variable; hex blobs -> md5(constant _kb) -> openssl AES-128-CTR IV 0 -> gunzip, run via eval
Firstseen:2026-10-23 11:28:47 UTC
Lastseen:2026-11-10 19:27:54 UTC
Sightings:13

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter