MalwareBazaar Database

c4ffeine

Foxveil 'cc2' build Mach-O, the TENTH payload served from this one URL (fat x86_64+arm64, 921,696 B), fetched via Tor 2026-09-20 21:12:18 UTC, origin build time 21:01:38, 55 minutes after the previous build. The origin is nginx, so each build time is readable from the ETag: the payloads served behind this URL on 2026-09-20 were stamped 07:02:41, 09:02:47, 11:03:28, 14:01:46, 15:02:41, 16:02:02, 20:05:52 and 21:01:38 UTC. The job skips hours rather than running on a fixed interval, and the gaps measured so far run from 55 minutes to 4 hours 3 minutes. Hash sequence on the same URL: a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9 (987,264 B, 2026-09-18), ec780ca8df9d10df905f3f77641f88ece7651303843802c37a57c484c6251a42, 610ae82d0d872334ba68718030bdeb0c2d23ce592b4c9022fbb225b0208b884a, 233fd2c05865e6fc7034e61bf98e64f7afeb24c1b3e88539895eeff764ebb740, 336f4bf8eb4d76c91f936beabe3a061b43db46d2cc85e6dc82dd22f9194191fc, 8e7d88f5adef0f2706fbc6df433e3c76d81c4b799389319e60a4639fc1c088a1, f03b8beef33330786b3f3f12e2bf2c352d4f14b8e6d5a78180205c7cccdcefb7, 6f994814774412107510aede65422e66c1e825f57bd3ae5d0f173aa2c54893d5, a2da9aba412172006b2ba30e2168ec030dabcdf8c46e6895ffba1c26834251a6 (904,256 B, 20:05:52), then this one. The stage-1 zsh dropper at the same host has stayed byte-identical since 2026-09-18 12:56:51 (sha256 6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7), re-checked at this fetch: the delivery chain is fixed and only the payload rotates, which is why every build in this series arrives at 0 detections. Six earlier builds were unpacked statically and each held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. Against the previous build this one carries 45,124 arm64 instructions across 42 __text functions where that one carried 39,723 across 40, and a TLSH comparison of __text scores 54, inside the band measured across every earlier build of this family. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a 16-byte Cloudflare 520 on every path including the root. Not executed.