MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 158e11946bf88b2de4cabca7ea6b07dde9232c903a3925a60a3fd947bf1017b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 2
| SHA256 hash: | 158e11946bf88b2de4cabca7ea6b07dde9232c903a3925a60a3fd947bf1017b2 |
|---|---|
| SHA3-384 hash: | ed5ac0efcb6be14136eb6dc7a7e510fba2758622e34dae46852bbb1a0400a427cf24853db841e0397973ca97c29acc55 |
| SHA1 hash: | 2994acbd4b21395c060d87e1f0b8702854279f02 |
| MD5 hash: | ae47632b0744dc8f85829b1bfa106924 |
| humanhash: | comet-jupiter-winner-october |
| File name: | recovered_loop_158e11946bf8.scpt |
| Download: | download sample |
| File size: | 195'128 bytes |
| First seen: | 2026-09-18 05:29:56 UTC |
| Last seen: | Never |
| File type: | |
| MIME type: | application/octet-stream |
| ssdeep | 3072:6HSWrMbqv8NsilZ/1GH2IkVlds2LgZ117BGkE22iKwYnzsOEpm9HCeVmUMhSySj:6rM+UyilZ/1TLgZ/KwZhm9HpMhSySj |
| TLSH | T1C21408DD7CEE054BFCB30632BAE00AAA49FB6F2561961C7D745932050FA1A813E1F617 |
| Magika | unknown |
| Reporter |  c4ffeine |
| Tags: | AMOS apph4 AppleScript Foxveil macOS scpt unpacked |
c4ffeine
AMOS stealer stage of the Foxveil 'apph4' build, DECRYPTED from the loader rather than fetched: a compiled AppleScript (FasdUAS 1.101.10, 195128 B) that the loader carries as 77 separately AEAD-sealed strings and assembles in memory. Parent Mach-O sha256 f3b6962c49b361c63fe9d0af9a83e10a52133360117e4c8ac68272160a60edac (MalwareBazaar, first seen 2026-09-18 02:35 UTC). Scheme: HKDF-SHA256 and PBKDF2-HMAC-SHA256 (112121 iterations) over constants in the binary, then per-item AES-256-GCM with the 16-byte tag stored apart from the ciphertext; part of the key is a SHA-256 of the binary's own __TEXT,__text section, so patching the sample silently breaks decryption. Config recovered from it: telemetry http://178.128.253.92/api/metrics/run, exfil https://jadeleap15.com/contact, modules https://rudder-moss.com/zxc/{app,apptwo,appex}.zip + /zxc/kito + /zxc/mdw. Targets 295 Chrome/Chromium wallet extensions, Safari and Chromium cookies and Login Data, Keychains, Apple Notes, Firefox key4.db; persists with a LaunchAgent. Nothing was executed; the parent was fetched over Tor and processed only in an offline container.Intelligence
File Origin
USVendor Threat Intelligence
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MAC_Sample_Unique_90afbc8e |
|---|---|
| Author: | Marjoriefort |
| Description: | Specimen unique (soumission Bazaar) - strings distinctifs propres au sample |
| Reference: | 90afbc8e8c3f9ad84d663cb6ba17f60cc97cad23d39f2548bc3dfa752ed9a9c5.scpt |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
158e11946bf88b2de4cabca7ea6b07dde9232c903a3925a60a3fd947bf1017b2
(this sample)
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.