🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AMOS


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f
SHA3-384 hash: b44c5a8eca7bad6746037e9524f6dbfef8ba64a20df7de3786b8765462d34a146ce3dbd4720c4afda34f197f1c420d3d
SHA1 hash: a7c3259ceb2a396ef81b525f55c103b358153141
MD5 hash: c1feba5fe41efcaf6e9ad346c38ca3ef
humanhash: cardinal-mexico-jersey-echo
File name:stage1_40f88f640c15.zsh
Download: download sample
Signature AMOS
Create hunting rule
File size:3'147 bytes
First seen:2026-10-17 10:25:54 UTC
Last seen:Never
File type:zsh zsh
MIME type:text/x-shellscript
ssdeep 96:/7gUw+wnCX873ZckEpjqZbehyQZkX8/DCmOWXP7CxOxR:/c73Zc4ehyQCXyCm4EH
TLSH T16851C6A0D43488F3E0A5553EDE82786847EF32DF58E4BC28F4A8BC84436FBC85169619
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter c4ffeine
Tags:AMOS ClickFix Foxveil macOS zsh


Avatar
c4ffeine
Foxveil ClickFix stage-1 zsh (3,147 B) served to a curl User-Agent at https://frame-kite.com/curl/pwnbcptu5/8jpm8xq5yprwztoh.txt on 2026-10-17 10:22 UTC, fetched via Tor. Const-key AES-128-CTR + gzip wrapper; the decoded stage-2 sends telemetry to the known Foxveil host trekkernel4.com and downloads the Mach-O loader from https://frame-kite.com/f/rjcf4ggdrb1wp5syzplnda/5r7r2qc0. New delivery host (Dominet, registered 2026-10-16, Cloudflare-fronted). Not executed.

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad3550bf4e17c78f71637b9
Tags:
n/a
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6ad355067bb17c4233a78931/reports/dc6970a6-db46-4154-b49c-35dc707d2ce8/overview
Verdict:
Malicious
Labled as:
OSX/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-17T08:34:00Z UTC
Last seen:
2026-10-18T17:52:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f/results?tab=lookup
Score:
7%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f/
Threat name:
MacOS.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-10-17 11:00:41 UTC
File Type:
Text (Shell)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=id4i6zamcx7jjw6ox6zcncsapsld2dfnnplqpwb2ttcixnxr5b7q._file
Malware family:
AtomicStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/40f88f640c15/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Amos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Foxveil_Stage1_Zsh_ConstKey_AesCtr
Create hunting rule
Description:Foxveil ClickFix stage-1 zsh dropper: hex blobs -> md5(constant _kb) -> openssl AES-128-CTR IV 0 -> gunzip -> zsh, behind a decoy maintenance script
Rule name:MAC_Dropper_Shell_CacheMaintenance_AES_CTR
Create hunting rule
Author:Marjoriefort
Description:macOS fake cache-maintenance dropper - payload AES-128-CTR via openssl, noms de commandes fragmentes

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AMOS

zsh zsh 40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f

(this sample)

  
Link
https://www.virustotal.com/gui/file/40f88f640c15fe94dbcebfb2268a407c963d0cad6bd707d83a9cc48bb6f1e87f
  
Delivery method
Distributed via web download

Comments