MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AMOS

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965
SHA3-384 hash:	fe968c6bb4bf40888444b8ff67ca18bde19c83eb14d6aa334a3a1591063a3ae7e6fa40bde58a069dd2b9e00ec7687a0c
SHA1 hash:	85c46e28454aeffe38299fd086b3fa53d8894a55
MD5 hash:	501a21c84e2a80eee15227c97f401a42
humanhash:	mike-quebec-eleven-blue
File name:	macho_3ae3d11cd46a.bin
Download:	download sample
Signature	AMOS Create hunting rule
File size:	2'135'456 bytes
First seen:	2026-10-16 00:39:59 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	49152:GLvJGGszLKQc7x2RnH9urkqSd0sratpkGKNX:YvJT2NdurkqSd0sz
TLSH	T150A5F1148A57626AE66A34B39C630FDD646062C05A582EFB6530CF351F33783B967F32
TrID	69.8% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 15.0% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2) 15.0% (.CLASS) Java bytecode (7001/2/1)
Magika	macho
Reporter	c4ffeine
Tags:	AMOS ClickFix Foxveil Loader Mach-O machO macOS

c4ffeine

Foxveil 'willow' build Mach-O, the TWENTY-SIXTH payload served from this one unchanged URL (fat x86_64+arm64, 2,135,456 B), fetched via Tor 2026-10-16 00:25:48 UTC, origin build time 00:05:33, 1 hour 59 minutes after the previous build aa2a4e66e81e492392b4e1c78fff9635fa63fc2d4d7f4c6b6438367ce4fd9aa1 (built 22:05:34). Loader code differs from the previous build by function-level CFG match (fv_codehash REVIEW, TLSH of __text 171) and a payload table of 263,576 B plaintext against 257,980 B, but the wrapper moved with this build: Same log-collector loader generation as willow 25 with per-build churn in the live loader functions, masked decode table, key schedule unchanged. Same stealer as willow 25: 57 handlers both, similarity 0.822, kept 263,576 vs 257,980 B, no new host, path or LaunchAgent, config still env-injected. Not executed. VirusTotal: https://www.virustotal.com/gui/file/3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965 Hybrid Analysis: https://hybrid-analysis.com/sample/3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965

Intelligence

File Origin

# of uploads :

# of downloads :

173

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.MacOS.Agent-BWZ.15449883.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad1b5086f551121ba168048

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6ad17280c080dcbbba75f89a/reports/42b5282c-4e78-444e-af3a-2bce7bd262b7/overview

Verdict:

Malicious

Labled as:

Mac/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965

Verdict:

Malicious

File Type:

macho fat

First seen:

2026-10-16T12:28:00Z UTC

Last seen:

2026-10-17T20:19:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965/

Threat name:

MacOS.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-16 00:40:38 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

3 of 36 (8.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hlr5chgunlho5alyh6ysatck4q2ftztqvadr65wivgsykeuhvfsq._file

Malware family:

AtomicStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3ae3d11cd46a/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Amos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3ae3d11cd46aceee81783fb1204c4ae43459e670a8071f76c8a9a5851287a965

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Foxveil_Loader_TaskInfo_Variant Create hunting rule
Description:	Foxveil macOS loader (ClickFix -> AMOS), quill generation with run-time settings back inside the payload script (no constructor settings file): fat x86_64+arm64 linking CoreFoundation+libSystem+libc++ but importing nothing from CoreFoundation or objc, with the task_info/mach_task_self_ resolver core in both slices inside a per-build random libc decoy import set