MalwareBazaar Database

c4ffeine

Foxveil 'haven' build Mach-O, the TWO HUNDRED AND FIFTY-SIXTH payload served from this one unchanged URL (fat x86_64+arm64, 1,857,488 B), fetched via Tor 2026-10-28 00:08:21 UTC, origin build time 00:02:26, 1 hour after the previous build. The origin is nginx, so each build time is readable from the ETag: the payloads served behind this URL were stamped 2026-10-16 08:02:26, 15:02:33, 16:02:20, 17:02:26, 18:02:20, 19:02:26, 22:02:21, 23:02:25, 2026-10-17 00:02:20, 2026-10-18 00:02:21, 20:02:19, 22:02:22, 23:02:27, 2026-10-19 00:02:21, 01:02:27, 02:02:19, 03:02:27, 04:02:20, 05:02:27, 07:02:27, 08:02:21, 09:02:26, 10:02:23, 11:06:48, 12:02:21, 13:02:28, 15:02:27, 16:02:20, 17:02:25, 18:02:19, 19:02:26, 21:02:25, 22:02:21, 23:02:25, 2026-10-20 00:02:20, 01:02:26, 02:02:22, 04:02:22, 05:02:27, 06:02:22, 07:02:26, 09:02:25, 11:02:28, 12:02:20, 13:02:29, 14:02:21, 15:02:26, 16:02:21, 17:02:26, 18:02:18, 19:02:26, 20:02:21, 21:02:27, 22:02:19, 23:02:28, 2026-10-21 00:02:18, 01:02:26, 02:02:20, 03:02:28, 04:02:23, 05:02:27, 06:02:19, 07:02:29, 08:02:22, 09:02:26, 10:02:21, 11:02:28, 12:02:18, 13:02:27, 14:02:21, 15:02:28, 16:02:19, 17:02:27, 18:02:19, 19:02:28, 20:02:19, 21:21:50, 22:02:23, 23:02:29, 2026-10-22 00:02:20, 14:02:22, 14:11:57, 15:02:28, 16:02:19, 17:02:26, 18:02:19, 19:02:27, 20:02:20, 21:02:27, 22:02:19, 23:02:27, 2026-10-23 00:02:19, 15:02:27, 16:02:21, 17:02:28, 18:02:21, 19:02:28, 20:02:21, 21:02:25, 22:02:20, 23:02:26, 2026-10-24 00:02:20, 2026-10-25 08:02:20, 09:02:27, 10:02:20, 11:02:25, 12:02:21, 13:02:30, 13:54:59, 14:02:27, 15:02:21, 16:02:24, 17:02:19, 18:02:27, 19:02:21, 20:02:26, 21:02:20, 22:02:27, 23:02:18, 2026-10-26 00:02:27, 2026-10-27 00:02:25 and 2026-10-28 00:02:26 UTC. The job skips hours rather than running on a fixed interval, and the gaps measured so far run from 7 minutes to 7 hours. Hash sequence on the same URL: c218c7836b22979e9889d464dc8a729ad407aa0f0ecb1e306305ed98d91b0e31 (2,119,440 B, build time not recorded), c3b8375f092798ac851bfacdb94310ccabfebcbe106f6e7324764a0e4fd4ea57 (1,857,184 B, 2026-10-16 08:02:26), c217cc02dd329a1c71c332f04cd0143298bfbec5ae9a1e4b0c476816a65d65b1 (1,807,360 B, 2026-10-16 15:02:33), b1226243ff5d2a5f6e69dabcbe03782972bcb4b13367d9d18bc9c53e6a68d1ef (1,791,152 B, 2026-10-16 16:02:20), 66e39783549a168d618619adc595c11af81ed2765a4e4f8aa14ae61dace613e4 (1,823,744 B, 2026-10-16 17:02:26), 1771355f1a58be5a59a0c4864fc49f10f8facb28e765eb5e6708ab6d96a337f3 (1,971,168 B, 2026-10-16 18:02:20), 530a0fcceb59a79c9780e89d7a0605fc0592bb6caee1248de6cda112036d684a (1,922,512 B, 2026-10-16 19:02:26), 28b2271555f8e7aca65d2092a7fcf2e7ece16e064e45230bc224435d9cefbb41 (1,840,560 B, 2026-10-16 22:02:21), 73f9efe6d64536122be91ecda713425a0112e6aaf35fa5d80ced7ac9510b9de4 (1,873,152 B, 2026-10-16 23:02:25), 796fd2f47ba19b912e7923cf2cf8225869a29459b330dad294ff54a923337761 (2,037,808 B, 2026-10-17 20:02:21), fb617d2319c498e327069f1ebbcc1c05756c894bf34ff0f879f0f8a82ffbaf1c (1,856,384 B, 2026-10-18 19:02:26), aeba6d2af47c87977b0525c6e640cb769b4bd3d866956f7dc8d0c6bab48e7495 (1,725,744 B, 2026-10-18 20:02:19), d24a2e1d6ece4780a6c47bc355dbe1918c20366daaafbcd68a82b501de461efe (1,955,232 B, 2026-10-18 22:02:22), 8c0137506ab7d5fc2ab411acdbc8f729399027568c5fc892371e5d89edb6897d (2,004,512 B, 2026-10-18 23:02:27), 3b4e7678e31e4b245db656358580539e7e5837e3f60d3e8bfd290a7667950ec4 (1,906,448 B, 2026-10-19 00:02:21), 18a871305fff238ac80a26688062f430742c02c8f28f4d82a9cc5ae2f180ce6a (1,757,968 B, 2026-10-19 01:02:27), d3a00e49c779f4297a0d570872d9bf93d67ddc7630b2057d5f250a3d7ca6b423 (1,660,384 B, 2026-10-19 02:02:19), 8b01511a3869c136edae8f195232d79c35bbe13592f0a020534892f933c0df41 (2,004,640 B, 2026-10-19 03:02:27), 1fc2328b5cece9c69a22a0b1eb97d8af64cf0b08e03f99ef801fce7142aa31a4 (1,807,568 B, 2026-10-19 04:02:20), f4772892868acbe01809bd1d0221d18fe3bde0fd0cae7ae53a16b450410a5479 (1,922,480 B, 2026-10-19 05:02:27), b618703253a9c9f2cb17644d60398f99de4c4906f16ccc2671058ff045f1c072 (2,185,200 B, 2026-10-19 07:02:27), deb4c9818b9ed4c4fc24742148cc522529210e1c55faf13089e228196dcf8244 (2,037,872 B, 2026-10-19 08:02:21), ab5b9b53b603bc5bc8abb0eb0aab014d82d20b603b40fdc69642b5b907fcea43 (1,725,184 B, 2026-10-19 09:02:26), da2e83c72314e027933e555a22316c75af4e37b0641350ae259552b4f2d3091a (2,200,976 B, 2026-10-19 10:02:23), 3100dde572a2915b684c3d349a86a7c44d4f9fd9467cfbdb424a72d9380a23b4 (1,725,728 B, 2026-10-19 11:06:48), 53c629613427d8b2f280e4102ae295c476d3cb547d9053c3817302c6dcba4b10 (1,905,824 B, 2026-10-19 12:02:21), 1384a37d7b21a1cc8313e9b094c8d1e0cfbec72d5bf3a73d12c2506198fa6964 (1,956,128 B, 2026-10-19 13:02:28), 12864acb33d3c86a1d6841c98430a2d385c392b41b992b8f0b20d64bdd6c4d00 (1,890,048 B, 2026-10-19 15:02:27), ea86e6c3922714e144154180abaeb26f2502b719cc3f542a99753c08d360eae3 (2,102,640 B, 2026-10-19 16:02:20), 00e0bae226b9e46ce1397396995c9d01ac9441f8296bbf33c70d83c350d4e757 (1,841,104 B, 2026-10-19 17:02:25), ca6b3fd74b48161e87cdd67ed87098661c72c89212b06fdec6dbe8ef65bd3342 (1,857,104 B, 2026-10-19 18:02:19), 87d29dca3253ac908990ffab6e9a177209394f6cbaf45b1817433452e2b2d97a (1,938,128 B, 2026-10-19 19:02:26), 989b86835519fc0354d7ff54d2b5162c639d98b642835bcf4c822188e039e9fa (1,775,312 B, 2026-10-19 21:02:25), ef2f81988ce0bb0aaf32e9a68780109e8756d94bbc3273182ffdb3892edb5930 (1,988,736 B, 2026-10-19 22:02:21), 591c35f12f34a681462a3507690dfa355700747486f1ace25b34468936b00b81 (1,774,560 B, 2026-10-19 23:02:25), f59d0a5f63972619bb2c5184cecbe7d4fc59d5e291ede27ba13acbe49dab839b (1,922,448 B, 2026-10-20 00:02:20), 7e7d9bb3a750416b663cae2ffcb65c299af1c2cbd99e3fb9012b8af7f8de432f (1,839,744 B, 2026-10-20 01:02:26), ed95369412065c36857f688d4cd1530c6d17bac292eb424dfa855ab1df349caf (2,151,856 B, 2026-10-20 02:02:22), 10bccd03d04a7661292b56ae457e5f2e6e2e4f8b4c9f72ae2a60ce69e64f559c (2,037,392 B, 2026-10-20 04:02:22), c0280b9de009145639346fdcc3c188519dc6c57740d56f123de6d13cf7d9d2d6 (1,955,184 B, 2026-10-20 05:02:27), fdc3066c5022c84972482231f2858ebcaf80e149bfa8eecb8e507b61ee68c04a (2,250,448 B, 2026-10-20 06:02:22), eb5f3dd2a5053e750d10b4c520b0fea07f306b717598a8828b9fa953e406d212 (1,905,264 B, 2026-10-20 07:02:26), fd3e76d1df8f9462597615cf73254faa79311f3879dab815ed18c14f32a80689 (1,791,776 B, 2026-10-20 09:02:25), 7a403e569174a8ee29ad8adcae289378112647c53a6089b45ad431a555b13892 (2,053,168 B, 2026-10-20 11:02:28), 51445b577b06a5c12de14e895b552df5dc00dc3d1773abb7af337e5d59f70a19 (1,971,440 B, 2026-10-20 12:02:20), a1766ce87de0a6998148eda427155c12a3cd682a9bcbc9a5725b5be61881c7e0 (2,086,736 B, 2026-10-20 13:02:29), af5945fc5765b5afce0b64f60689bc5ff7131d4e9ee6c2d632b0fd7a8bea4a25 (2,053,600 B, 2026-10-20 14:02:21), 224198022e893bf4e31a5baf41896a4f00dcea26d5d2fdf9ca085c67c4861133 (1,939,168 B, 2026-10-20 15:02:26), 9702c49ec522cb2b5029fcf131f68694ca163f1898788f734f077f84ab47b643 (2,249,408 B, 2026-10-20 16:02:21), 9ff5f3cbe9d011b755c7753b0b3a1b2f9c479089f443b8ff63d3270797da0928 (1,823,312 B, 2026-10-20 17:02:26), 142818189ff68ee72b1bc357e658d2a6307eba97b24069199a76050488abdb84 (1,807,088 B, 2026-10-20 18:02:18), 45bc39419cbc26b84830655657741a489bf112e76b96a03b8c94be3b442fc7a4 (2,004,256 B, 2026-10-20 19:02:26), cda6df0d2759965121426d1444204fd1b14d7636a9f13c1a95d2834777b55daf (2,053,104 B, 2026-10-20 20:02:21), 64d36fbccffa093c8975265608b7fc21036edd05d0185e27f37b373499169ee4 (1,905,536 B, 2026-10-20 21:02:27), 38011ba5e876d84ef43c68dd1a9a32db5a41599963230311697fb96374dc7666 (1,578,016 B, 2026-10-20 22:02:19), afe672494577b9523d97158be6d4d51373ce3c637b1c02ae8de30d404d8da01c (2,168,304 B, 2026-10-20 23:02:28), 09b5143a55acbb87423681f6c70a1bbed0034289a7448becc5d3adab51fddb77 (1,807,712 B, 2026-10-21 00:02:18), 7307d9f515f0d32c4741dbb7d11d25d84f057e7eb9bd17127a71f6a5222fbd7c (1,890,064 B, 2026-10-21 01:02:26), 0093309154768c89403369530b3f4da4e77b6395c95bdd754ed765dd3e83e521 (1,971,968 B, 2026-10-21 02:02:20), 64d9ba25063f6c1b6f3e2c931a63b519a1366f8094765dde6e6da3f5f8d45594 (1,988,576 B, 2026-10-21 03:02:28), efd5fbce12a6b9c66b1154ee667303d379541b0eb19c44c2864067fe8648d28f (2,233,680 B, 2026-10-21 04:02:23), 3ccb1e87569aa54f604e7be53de7f4167df146b8be85a2fbef1a9bd962700394 (2,135,632 B, 2026-10-21 05:02:27), 2ae73a8f4057f41a4de7c2e2f19d8e6cd1db9e4828306996e5a0e5aa8fd3ebe5 (1,921,296 B, 2026-10-21 06:02:19), 7bb169e7d40a9d77c9e997ce4e4db340a17ee75b7c28d3f8c34ce8c310691627 (2,053,712 B, 2026-10-21 07:02:29), 3e4599dab6a8e56a5328e03053470a9d66252a69d1abfea6e7c0b269b0fe85eb (2,216,992 B, 2026-10-21 08:02:22), 7359b18a52b906e2d3b75663330433fc1362213286b3aefcfadf3124c404d295 (2,052,720 B, 2026-10-21 09:02:26), c81f53d8dd38fb06d94c9587da1c4af20765b982697a8a4e0d4a624e411eeb4e (2,119,904 B, 2026-10-21 10:02:21), f2506201e049e9fe2242137a3e0ae1c6de67bb525af3e9f6959cd2500c6c76ab (2,004,368 B, 2026-10-21 11:02:28), 3e0773af5ccb3c201b3acb64b56d55282d95421441874e3d14695e51adb98719 (1,840,096 B, 2026-10-21 12:02:18), b4ec1ea1528a1cf690b1067a214751cfee1ef0eca037c7989b4bef17fbf6b53b (1,888,864 B, 2026-10-21 13:02:27), dd8e63bb4603758b3e422955e79af976005cf4302a62f2d6e432ee287dd03c36 (2,283,760 B, 2026-10-21 14:02:21), c1284b1036760e68e152e87ab00d5408a7a5f7c09ef2cb4dce6f01bd28866eba (2,070,224 B, 2026-10-21 15:02:28), e4090caad6494e0d3a5f9da7a36df462911303792eb2e94637bf6b3c6d3b1e1a (1,856,816 B, 2026-10-21 16:02:19), 2cee11bb3cd4703a26e1779acdcd1e800e8b7a909a2820d64ab6a0aa713989c6 (2,101,952 B, 2026-10-21 17:02:27), b62d122a5ef2fa5ed11d1f479cb49c979c810e01a40b9d66c92bb81d81fb352e (1,938,832 B, 2026-10-21 18:02:19), eed2a8636cb34047787ece6b4311bc57c8b89d7bed4dded4dcbcdbe5494f0bee (2,070,656 B, 2026-10-21 19:02:28), 50d4fff947a088ae8ec59036335a09be118c4aa8e77bce7cc9eae4f3d9319f17 (1,774,032 B, 2026-10-21 20:02:19), 032ca6eca0f327d15053db625bd375b96a96c82885a4cfafe4bbae004f7c8a2e (2,053,792 B, 2026-10-21 21:21:50), aa755e4f490fd50aacaec3727c810a54f5aa74ec230582d1a81ce72170316da1 (2,184,656 B, 2026-10-21 22:02:23), a833c1778f7205159a00eb53913e1323e8125a17c070fb5fce3a8b339f9eeea9 (2,200,848 B, 2026-10-21 23:02:29), cda8c42296e126d051a47e80cb8e6141d89bfbb76bca014b4cf1c64221742645 (1,905,968 B, 2026-10-22 13:02:26), fa642c791adbb70dfb9841f366cadd88001e5dd10ec267efa1e6c0d1e1ad66e4 (1,741,824 B, 2026-10-22 14:02:22), a347dc4491af8d9abb89e2756b2a17f1821ebca83d58846c3460512c4c7bd3fe (1,856,912 B, 2026-10-22 14:11:57), 4a7b53249691196a6798b22502c3c88ca41ffb9b07c715665f9d2298f47a4a2c (2,184,288 B, 2026-10-22 15:02:28), ecd97cc85594ebd02de6dcf86f8c42630d5a44a4000bd1aa75b5cb820870fb45 (1,824,016 B, 2026-10-22 16:02:19), 455cc39e56dfcb66a70c7f058ad3775848d9083d16c4c1417060cb82325cf26d (1,939,616 B, 2026-10-22 17:02:26), bf85f3da0fc4ec06376ea69cd0cb7d697220621c77c115e454ed22f97e8f07b8 (1,840,864 B, 2026-10-22 18:02:19), a26e661c00da516c44cc70c2edcae3467cb397565386604b4e9118d2e2808630 (2,152,512 B, 2026-10-22 19:02:27), 6e9127f00a6a30d1def3f6bb87b2ad2ac412b6d444ceda56825a5db7e70088d7 (2,005,104 B, 2026-10-22 20:02:20), 57c48bc3789cadaab1aea6818f1fe9a5afef6178821aee405bdfd89c9017d7f5 (1,954,448 B, 2026-10-22 21:02:27), 043e40522f0f68df2c7ee48a734f244d599870af08a022fa1582d8484f3755ae (1,758,816 B, 2026-10-22 22:02:19), f3aae835f17f3470da3ed28ce79ea92224ad4b803c7d9ea279ec7bd4934e7718 (1,873,984 B, 2026-10-22 23:02:27), a06e0184a9b8d48c74a5a7533dc8728cd58c497a4758ae13247ec433df01ebfe (2,038,128 B, 2026-10-23 14:02:22), d46030a29fb6849da9d04da8226c766ef3d7ef4d2ffb602772e4080423880d22 (1,954,720 B, 2026-10-23 15:02:27), de6d1c265678b8b0af0c8cdb34b5f5feb52567b29bc3ed2354fc01fc13e6bd8e (1,922,240 B, 2026-10-23 16:02:21), a2aec7053cb3d47f49cb9716b5269dba58d4a953f4bb9db118f8334c9a551aac (2,119,536 B, 2026-10-23 17:02:28), 45471298da7cf8d412a4102e2a74ce2244a3beb97eac2d646496479ecb21dffe (2,004,336 B, 2026-10-23 18:02:21), cea730756ef2f2d964c737d4e32f1bf9b606f9834f1f0eb84529d5c1e4e4ce12 (2,103,056 B, 2026-10-23 19:02:28), 22eb5e6d923525964dd1b2216587352bb417dc76b3d42c8d0ac2662c74e91d5d (1,987,776 B, 2026-10-23 20:02:21), fb940dae06a7245b8cdc9893efd2abefcdc1a39f5a69e3f797edc1a706868c6e (1,709,696 B, 2026-10-23 21:02:25), 31ac82ef49f69f7f2772efb1f8e29fd374bbf09e21e15d6708f52bc497cf5e6f (2,037,424 B, 2026-10-23 22:02:20), f603ab3a140307f8f6f4c73f529e743969a70f9367efefc083118e8de3702c27 (1,873,024 B, 2026-10-23 23:02:26), 15195687bb341acaf28600d9ebc4bf6c3a6361d71575810b19e10c00c3e314ee (1,906,544 B, 2026-10-25 07:02:27), 4216ed59345fdcf0426c9f8c7d46e1e6119d634ccbc0b681bf254199b97023b9 (2,086,528 B, 2026-10-25 08:02:20), ff68b3c9245137a6577593ebe7676cc712e0db580823b64aff2103c1cd671354 (1,987,600 B, 2026-10-25 09:02:27), 4675b3d65258eb3b2c37146964c88afd4ef3235270a6ca3e0bff112fb65f6c79 (2,004,144 B, 2026-10-25 10:02:20), d207e55f2161bcad1064d967b728261a012d54876359b1fb9704b5c4134e6024 (1,808,304 B, 2026-10-25 11:02:25), f203a7c303dac1f6fb6f1d78da962f152edafe2280ca48088152533c81ee23ea (2,053,520 B, 2026-10-25 12:02:21), 0f4e518c7e282090f4a5298c44f6db101fa6495346ef42cff5b848f7177ac200 (2,021,136 B, 2026-10-25 13:02:30), db40a5be1b8b17ecaec4fb80343ba7177c63be36767eb6ccb2af482828f34948 (1,971,376 B, 2026-10-25 13:54:59), e481c0fe6e61e986f630625775623401efe205f5243345677574e6562c06c658 (1,856,656 B, 2026-10-25 14:02:27), 8b6ed97b8951aa514d829ba5dc6f601c093fff170710c1a4c9aa8306ce35bdc3 (2,184,944 B, 2026-10-25 15:02:21), 1293bc94bc3ac2fcdd2bfb3086583313d60c5a4073b3e255a8905094c8cceb38 (1,659,728 B, 2026-10-25 16:02:24), 51c602bb1b62272380b9e4545fd40ce3905afb5f692d390c5dcc078375b383d3 (1,709,696 B, 2026-10-25 17:02:19), 8e52fd4e76ab69e968cb7caac984646abfcdbc2071cf5c4d8559dd14fb5529f8 (2,152,048 B, 2026-10-25 18:02:27), 81b12b6989957ccae8cb00903b6be7d6d9952f0c4136aad827a28bdf96cb253b (2,201,120 B, 2026-10-25 19:02:21), 5723065bb32f424c666124b1ca6950f198f43afef0183f6e0dafc95ab9d3bcba (1,922,688 B, 2026-10-25 20:02:26), 10d8854cd25c6e23060d4f0606f9091d0753d1f2264da7c184e682bf2f07bdca (1,905,856 B, 2026-10-25 21:02:20), 61bdc206a61da7749f7cbb86364257b1407478ba6e8be2485584abd29c8ee3dd (2,037,392 B, 2026-10-25 22:02:27), 337f0b1329d19d47e4697b20c8d8bd756626e90b356f121f6ac0b3cdf193ac20 (1,676,064 B, 2026-10-25 23:02:18), 2a21ad53a61241180857ac9d179b577cf4e677f7c0c45873160bd5a1e7b5445c (2,184,624 B, 2026-10-26 23:02:23), 87b1bb9726e1a2d0e3a23c442780ff3f7c34d0038495ed12d3d9fde53d8b15fe (2,200,736 B, 2026-10-27 23:02:19), then this one. The stage-1 dropper on this host is not on our watch list, so only the payload URL is measured. The first build in the series was unpacked statically and held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. This build compared against the previous one: 46 __text functions against 44, TLSH of __text 110, within the range measured between builds of this family. The encrypted payload table holds 64 items totalling 265,148 bytes of plaintext against 78 items and 264,428 bytes in the previous build, a 0.3 percent move: the same script re-chunked. This build was not unpacked. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a Cloudflare 520. Not executed.