MalwareBazaar Database

c4ffeine

Foxveil 'quill' build Mach-O, the SIX HUNDRED AND EIGHTY-FIRST payload served from this one unchanged URL (fat x86_64+arm64, 1,758,064 B), fetched via Tor 2026-10-31 00:26:09 UTC, origin build time 00:09:49, 1 hour after the previous build. The origin is nginx, so each build time is readable from the ETag: the payloads served behind this URL were stamped 2026-09-25 11:30:01, 20:09:51, 21:09:51, 22:09:57, 2026-09-26 01:09:57, 2026-09-27 00:10:03, 2026-09-28 00:10:10, 2026-09-29 00:10:16, 2026-09-30 00:10:14, 2026-10-01 00:10:21, 2026-10-02 00:10:21, 23:10:38, 2026-10-04 00:09:39, 2026-10-06 00:09:39, 2026-10-07 00:09:51, 2026-10-08 01:09:57, 2026-10-10 00:08:45, 2026-10-11 00:08:45, 2026-10-12 00:08:51, 2026-10-13 00:08:57, 2026-10-14 00:08:57, 2026-10-15 01:08:57, 2026-10-16 00:09:19, 2026-10-17 00:09:20, 2026-10-18 00:09:21, 19:09:27, 20:09:20, 21:09:25, 22:09:22, 23:09:26, 2026-10-19 00:09:22, 01:09:28, 04:09:21, 05:09:26, 07:09:27, 08:09:19, 09:09:26, 10:09:18, 11:11:28, 12:09:22, 13:09:26, 15:09:26, 16:09:20, 17:09:28, 18:09:19, 19:09:27, 21:09:27, 22:09:22, 23:09:26, 2026-10-20 00:09:20, 01:09:29, 02:09:20, 04:09:20, 05:09:29, 06:09:23, 07:09:25, 09:09:27, 11:09:27, 12:09:21, 13:09:27, 14:09:21, 15:09:27, 16:09:21, 17:09:25, 18:09:20, 19:09:25, 20:09:20, 21:09:26, 22:09:27, 23:09:34, 2026-10-21 00:09:41, 01:09:47, 02:09:37, 03:09:46, 04:09:39, 05:09:46, 06:09:39, 07:09:45, 08:09:40, 09:09:43, 10:09:40, 11:09:45, 12:09:39, 13:09:45, 14:09:38, 15:09:44, 16:09:39, 17:09:44, 18:09:37, 19:09:44, 20:09:40, 21:29:18, 22:09:41, 23:09:43, 2026-10-22 00:09:39, 2026-10-23 00:09:37, 15:09:48, 16:09:39, 17:09:44, 18:09:39, 19:09:44, 20:09:37, 21:09:45, 22:09:39, 23:09:45, 2026-10-24 00:09:39, 2026-10-25 08:09:39, 09:09:45, 10:09:38, 11:09:44, 12:09:39, 13:10:04, 14:09:43, 15:09:37, 16:09:45, 17:09:37, 18:09:44, 19:09:37, 20:09:44, 21:09:39, 22:09:43, 23:09:38, 2026-10-26 00:09:42, 2026-10-27 00:09:45, 2026-10-28 01:09:43, 2026-10-29 00:09:50, 2026-10-30 00:09:51, 06:09:49, 07:09:43, 08:10:16, 09:09:44, 10:09:49, 11:09:45, 12:09:52, 13:09:43, 15:09:46, 16:09:49, 17:09:46, 18:09:53, 19:09:44, 20:09:48, 21:09:43, 22:09:49, 22:55:21, 23:09:44 and 2026-10-31 00:09:49 UTC. The job skips hours rather than running on a fixed interval, and the gaps measured so far run from 14 minutes to 8 hours 39 minutes. Hash sequence on the same URL: 0d70d0b4ce4bb2035aed62eefb21989f9ed3366a794d7998b4927a9722bad990 (985,808 B, 2026-09-25 11:30:01), 01d7e923a723802d5616af7d9c61dcb868b790f84b784b24db5bc9d127b0213d (970,912 B, 2026-09-25 20:09:51), 2420e2de98ee76343d761d6725f720d1e9adcbc38f116e9f939f407e8db1a9f2 (1,035,632 B, 2026-09-25 21:09:51), 998b688c5b40cb26cc22b86e32ad81ca1d9f85e30a61d832ca3163c55d734fe1 (1,069,184 B, 2026-09-25 22:09:57), b2873435bac0c041c75da1d812bacdc0219d4766228052dfd399b0cd919436a2 (1,068,208 B, 2026-09-26 22:10:03), 0bac9323a90662d0e2ca856c413444758db268a41745c652d3f1d9e0fcb261f2 (1,281,344 B, 2026-09-27 23:10:04), 7fa4151a68295e54afdc51df7041c4f1f852f74470c086f0ac4100439e75a331 (1,396,048 B, 2026-09-28 23:10:22), cb5fa67e0848aa6700e6b1b5b9c886f2f9c24b07acaad09fccdf44709eeb102f (1,052,800 B, 2026-09-29 23:10:21), 95cb09972b1584af34651d1f62a2a1b8ae2b1bd94967ad25d4c2cdc41da99530 (1,330,192 B, 2026-09-30 23:10:27), 3d33dc55b40687afe672eb82c68b89af1fa250db4391e2836c266289249a495b (1,232,608 B, 2026-10-01 23:10:27), 752e72d6e61bfa4dcd55c6e82d429e09e798f96ca2415e2b852321edf7807b52 (1,199,520 B, 2026-10-02 22:10:32), ee268aeb513501ab2147ff1963910e3279c2e794e542ae257a740ddf7e4431a0 (1,067,984 B, 2026-10-03 22:09:39), aa00225f01e1f8542d8275adb88936111ce387e8ec529b1566ff2532369737da (1,183,360 B, 2026-10-05 22:09:39), 746e37c45296c42d8bbd1f0c0aff7b6b20ecd14c1108e9899cc6cc78c2573fec (1,380,736 B, 2026-10-06 23:09:57), c3cc91ff61e4da3977a5de3336ddfe4ba737f951a354c5a987c9ef2491915bb0 (1,151,296 B, 2026-10-07 23:09:57), 27015e5d3fb643438d1a0d3387b6e254085e9d3218023a3064612836d1226ed3 (1,331,456 B, 2026-10-09 23:08:50), e8ff0ba3bfd76048aca15fb2fc417840ed93991a0e012435e290f520741c523d (1,397,296 B, 2026-10-10 23:08:51), daa27ba0977e6d202161bbbc6fb9fe22ca1353c5d8893bcf16892fe2b82e8405 (1,232,112 B, 2026-10-11 22:08:51), d077f79fc37da1fe146165bc617d74dd24f9aa71be51e7ad8f6cbcf26d2fd3e7 (1,133,520 B, 2026-10-12 23:09:03), b539c4cc58ba6c54d126e46c391a98f6619a97c859468abb4c5c299ce14d5bd8 (1,264,944 B, 2026-10-13 22:08:57), f3d8ed915b2a53a35e52bd1ec39c21deeaa831ae0a969221bb7bab492938ff60 (1,134,144 B, 2026-10-14 23:08:56), 714d4d3235dd25315c3396e13329342b14fe33ecffd4628d9b5c1481daf72016 (2,184,704 B, 2026-10-15 22:09:22), f9b55b2953762b0e118b1bec799d0bddc9cfe49f170da2428b4e6ef5ae31b1ce (1,939,040 B, 2026-10-16 13:09:21), 1c40ac1b4c9a79ea6077b440c3b7c176bc7e34535b29ccdff8171d0209df359f (1,905,472 B, 2026-10-17 20:09:19), 7541c80a8d88083f2489d2acfc96a41aa841f9d27d2b5c5052b087fedf16ab13 (1,774,656 B, 2026-10-18 18:09:20), 002c0ba824e249fbb67b3c91a0c5d97f22bef4f90c78451e9d6ebe9f7c5a3501 (1,922,784 B, 2026-10-18 19:09:27), e03049253c5b68f67d575be20548a6d80d1ed344010ce3e48a85d190cc1f608d (1,824,560 B, 2026-10-18 20:09:20), be74ad1c11fe9b7895f1d6a22d3c54ee2d254d6011891c6879876ddecc10dad9 (1,643,600 B, 2026-10-18 21:09:25), cb8d6fea3c15c1a5db5f7f176805703668b0d9b6587d6b9fdca56b89a581cbee (2,053,984 B, 2026-10-18 22:09:22), 92e72549aac041603981b9c513f0538c32224f08e4bb16b9b948b69fd5eec902 (1,972,160 B, 2026-10-18 23:09:26), 9010686b5dbea311ace010c27f660d9bfb5335595fefd1f66d6a911602c53536 (1,955,520 B, 2026-10-19 00:09:22), 0744e7bdd1959c48f0ab161bb1860c4da32df41f13094288697c3a2582f2d634 (1,955,328 B, 2026-10-19 03:09:26), 042444403a0733dba3d4c63e16ab48fd7da79519ca81193936594911b2200e13 (1,939,456 B, 2026-10-19 04:09:21), 607ee8b513400e7b3b2d7d7340da5d6fc89aa699427edd694ba617017500c59c (1,775,216 B, 2026-10-19 05:09:26), 73e786556199ae98e9fe423bf51606a9986c29d6c5a0fb0b02954a3b000f8871 (1,840,096 B, 2026-10-19 07:09:27), 2aba880c132444d0a53e56ea03bdeede3aec3272d233cb33497a1f556a52cbe5 (1,675,968 B, 2026-10-19 08:09:19), 5ec4fdc6a655c0261e9eb94db81c25e62fb75ef7fd1ee91499f04162a92e4dea (1,774,896 B, 2026-10-19 09:09:26), 3d562a03963c9fb357fbb54369724a07f70c5a665b3ee7cc12639d538d12c52c (1,856,816 B, 2026-10-19 10:09:18), 9e02e90c7ea01092752970a0708642ad236b55037d38a4b24f33190bfef8c2b0 (2,152,368 B, 2026-10-19 11:11:28), ec9c2e0489358859de1577405540a384d5a2e3cb094dbe3892bfea437a3927f3 (2,234,080 B, 2026-10-19 12:09:22), 5a35a7d01bf531ebc10ed7caaa9c5cf54333659cb00b24098f8d0cbd1afbc419 (1,839,712 B, 2026-10-19 13:09:26), edb17afb151aababd85ede0952f540b3f26d5e306062b3f16e2ee617daef0f68 (1,757,856 B, 2026-10-19 15:09:26), 23b1af0ff0d45a15c7687b57cedd8fcb5e12ffa453f9b626713fe8d47be5d8fa (1,692,816 B, 2026-10-19 16:09:20), c49b468a680f25623a26ea8197315e501d040dfed420b2ccd19c27b684eb0e16 (2,151,792 B, 2026-10-19 17:09:28), edfc9a144298bef7be177e54fc990670fb5521f5c44fd95d219aa3d6440c65b9 (1,578,032 B, 2026-10-19 18:09:19), b8b361af2f4795689feedb9aef172bd5d0288642354fa1aed9c0624b94fb2d3b (1,872,608 B, 2026-10-19 19:09:27), 4aeafe5efaa93b40d653c307e0b5615610b359866ab1d57f907bb2ddb86b5b55 (2,103,056 B, 2026-10-19 21:09:27), ce932136f1a892a9640babd29b1eb7fcae6bf72fda91550d3c651f202c0b9fd7 (2,119,040 B, 2026-10-19 22:09:22), bf62ecfac9d5e8b71be6d920033ad87df03e570385c2f6bfbe3923ccaa96e70b (1,856,336 B, 2026-10-19 23:09:26), 2f4b6d386a70eea4d5aaa951b8a9095095410cef0963b4a769aa9cc4b7e356a0 (1,758,672 B, 2026-10-20 00:09:20), f940436cb501da7b8d174699670083eedff857ccfc93eba66c40ae602237ac85 (2,267,040 B, 2026-10-20 01:09:29), 718d3907daebcebc65c36c06aa3c9f8d856f41b77c43e809379a1fbc4a5bf91e (1,972,400 B, 2026-10-20 02:09:20), 9e40c2c027e3bbbe89e9e4ddc1846ef271fc8d4c6c09282be4f7164cd96ca196 (1,823,920 B, 2026-10-20 04:09:20), fc3a6bb673f13f58450440641446b9d09b63e01ed20f556f5069e2616c4fa684 (2,054,224 B, 2026-10-20 05:09:29), eb0c15a7c1cc670a4dbc49d3b83f6b289e34e3b63a778c228a9dda7ea3b7e512 (2,071,072 B, 2026-10-20 06:09:23), 0eb00d1d7a7a8e13eef6d669058cbd0e56486086ecd7fea7dae515870fb6ab61 (1,758,912 B, 2026-10-20 07:09:25), 63d0874ad69ac447eedc1063dcc17304d516d19f767fa8fc7a14b13bc3953a0f (1,823,968 B, 2026-10-20 09:09:27), 09b6a0e73c5233c8475a14cd33def6a85799d82228bf127ff1c9dcde941e5707 (1,873,072 B, 2026-10-20 11:09:27), 455b24053a5659a38960141e2fa7b811e4678c29b3815780676fa755d838bfaa (2,200,976 B, 2026-10-20 12:09:21), ae5d9c57b98840a75670fd1a20da475fd0ffae2d47066bd8582368d737e346d4 (1,921,936 B, 2026-10-20 13:09:27), bdff1903e3588cd35d3ae606755ca5b88034d6ebc84e052c4e196f5138e2c06e (2,151,792 B, 2026-10-20 14:09:21), c818155ff0562fac0b182a3b1e962adf5f24de07f25bca90f6b8b75c5027753c (2,070,384 B, 2026-10-20 15:09:27), 19dae42087c116ebc870e69bd2d99c8204240d161ccb0aced3f8be86023170c5 (2,053,664 B, 2026-10-20 16:09:21), 52c5a8ba76566f910f60311e7c9882fc067da146dbecd2e09cfc7b9154c0196b (1,922,528 B, 2026-10-20 17:09:25), fdcca8f446359cca1589b6f942d8552cbb905d0d9b2fae0da4efe566dd0f8f99 (1,971,792 B, 2026-10-20 18:09:20), 01115ac784159dc46c5d383112a9bb9ac67135c681aab30661dba8c1431f7281 (1,774,544 B, 2026-10-20 19:09:25), a42cd1718ddd7014c0e42cc4afe55580ca4172418dc53540b9ff27baceed7667 (1,988,496 B, 2026-10-20 20:09:20), 9c3551bc157cb2a038915ba6708b8a41e7188c6ff96cb120d5fcd8218b160ea5 (1,725,744 B, 2026-10-20 21:09:26), 5fab71f992b5501af0eb0da8c98a233059e09735ff9895318f93a097c34e6325 (2,283,104 B, 2026-10-20 22:09:27), 855798b1f80339fbc98aa14bc6883991cd75bd30c53e3f80019d8f7c0c9f83db (2,217,824 B, 2026-10-20 23:09:34), 8dbaf51b30261245b9024dacae709f5f95fdf677044fb5d687c259ec828cbf4c (2,167,872 B, 2026-10-21 00:09:41), 8e6d44e94805e61dbb701ae4d125e2a97c46f48a8c6eb88e8d67a21b137fe8f7 (2,168,064 B, 2026-10-21 01:09:47), 21112db836d36eba9a30da83b431b899509f931395243bc9cfb22218fc28df21 (1,807,184 B, 2026-10-21 02:09:37), 6b7b2ec7b07f39e78c899fa934e6250a5d50b9cf52b32156e5dcdd9ec3952bd8 (2,037,056 B, 2026-10-21 03:09:46), 612b706f54d148111f20e393792fda57f73590b6bc6865a4e49656e670f9eefd (1,790,944 B, 2026-10-21 04:09:39), ff981137caf655ecdd27bbb9ca14bdd66dd5d3565fcd53a8073d0ee8ebb29338 (2,299,808 B, 2026-10-21 05:09:46), ae68ae51fc50608f00a455ba7fbf05294ae9e66b0dfe0f735951f37071e16d46 (1,938,944 B, 2026-10-21 06:09:39), b0499b224dae292daab94ddddbee3643133a32ac8b616503f63ee4dfd83642f8 (2,020,688 B, 2026-10-21 07:09:45), aa9fbed2905968ed8f3888fa9ec75b8d8935dfbc265e0513a139be8485b32f93 (2,118,448 B, 2026-10-21 08:09:40), c0fadcecae4308345a15364e0a8d5fb8b46924dc9bcd9025502c97279257b3fc (1,906,240 B, 2026-10-21 09:09:43), fd3988f2fc8bd69ebe48397fdfb082344eceab69f2801c23880865e7fea8ebb1 (2,054,160 B, 2026-10-21 10:09:40), 0a285cb3601f22e80adffa49ea241996b0dcd06731687e16f90604aca038fc96 (1,938,768 B, 2026-10-21 11:09:45), 9eabfb31f281ed61b993abe535472ef490a7ac5b94a78e9e229beae92b80b2cf (1,841,024 B, 2026-10-21 12:09:39), c6dcafd1aaa7cdbf84e2cc6f1f6b3e6cc6a7c1b74ab995003a5d6f828cdf1268 (1,905,712 B, 2026-10-21 13:09:45), 62994b44a23dfcaf192d2751ca4ec7148c32a830ca0fb64ee1e97e784e97be98 (1,824,080 B, 2026-10-21 14:09:38), 8b9fe9b386a1dc236e2b3018fbc548252635a861c0512058cd8ebb95a40684b9 (1,905,648 B, 2026-10-21 15:09:44), 59f52147191742aa71b4ef9c378ba1402df18bf643aa4d8e83c0a79eeb4269f5 (1,988,576 B, 2026-10-21 16:09:39), 4c4be5bde3694206992ab3c2fa6282a0324520506170996a035d99173a291b95 (1,906,176 B, 2026-10-21 17:09:44), 1aca10c8ecfa98591d5c75a0586aa4c57d8d0c6b59694ac34c347de3e9075b76 (1,806,336 B, 2026-10-21 18:09:37), 75245a2a0f845f9ff9f9feb6076f1d08c0dd19600b9f21359bf8882b63a84884 (2,020,832 B, 2026-10-21 19:09:44), a93b14cfe1d1e7f772b8e8e2e1b90dabc1ba63687497a38f0f6def5d49544f4f (1,955,648 B, 2026-10-21 20:09:40), 7300d563da3032500a4d1c9fdd92b8063819f28d25131a622f410c1fc4f01f5c (2,021,040 B, 2026-10-21 21:29:18), ab45a663946538d84003300f3cf7056825c9e4843e19efffdb9e9477f727a702 (2,184,112 B, 2026-10-21 22:09:41), cb69e3ac7766671076b970ff9517651fa0a80aaaa65342ad2cea5fdef4132ef6 (1,693,504 B, 2026-10-21 23:09:43), fd7a2fdce01faae3a187d50db6cf5cc0f0fceb2be27b8f15d483b34502b464bc (2,251,088 B, 2026-10-22 23:09:46), 9bfa622e37602bdf30d181842670449c61e45dd070f232fe84213b93a3cc5d75 (1,792,064 B, 2026-10-23 14:09:37), d8412f760d50380ef5175317f129c75a80e4c21c912d4b0336a395586accd97d (2,234,160 B, 2026-10-23 15:09:48), 03347ea4466ecbc01dbe24e74d34910069344a3f2f90ee021d5ebc8bae7d3233 (1,921,888 B, 2026-10-23 16:09:39), be571605929d03a2075d80fac90cc93994c851ce0fe85909116bef0613495303 (1,808,368 B, 2026-10-23 17:09:44), 07186145331ea813d189959826ccc9935c8d8f148faa5fbc23a576235ed61eb5 (2,020,144 B, 2026-10-23 18:09:39), 06a2dc91a0375a19587342781d97958e8ac699cdf7325dc69a0694c05d56e661 (1,726,240 B, 2026-10-23 19:09:44), 437a1e428bab9dc0a2347db5b1beff72c0632151a1e6e2b3bac08a449f07f615 (1,644,112 B, 2026-10-23 20:09:37), 816e590d1fa76073ffde36b2db9a2a443d1dc78e0b48aa0315073ffb7ac6da4b (1,971,904 B, 2026-10-23 21:09:45), e7d85ee98d57b280b6b017e2d5a556341b4b42dc2f2477a977fdaef7d8b24c7c (2,052,896 B, 2026-10-23 22:09:39), b9c807357b61d627c363ad68aec1233682177061abaf206b73296a2967154925 (2,053,952 B, 2026-10-23 23:09:45), 1cc15f077ed5c8d747b978172fd199d58eb9b4d99a7fa040f46112a8e6938e24 (2,070,560 B, 2026-10-25 07:09:45), ed12bdc03dadcc035f39822cba4eef1d69a215a797fc7f875ea65c5dcc0f919c (2,234,112 B, 2026-10-25 08:09:39), 9fb96ddaf0c6f6ff3c038084f7e0ec5c315f3aa09a3454bdc6a2552a4fa575cd (2,085,600 B, 2026-10-25 09:09:45), 73bfa8c95930d01415ce24310d6d6140b2f7c9590c24f26af414129efff3e824 (1,906,384 B, 2026-10-25 10:09:38), 8b692ea20ad28c04c4ecc0ccc1114eb1d40454069bc36b4fa3e76cc08530fc35 (2,070,336 B, 2026-10-25 11:09:44), d896b14c78190f0bc59cced80f5ef9f17e50221ee2968219b510f567d02f8cb0 (1,889,648 B, 2026-10-25 12:09:39), 3976bfc0d5d0e9c28af70dae30d5ec91d7223c35b0fa336c13093db904f97514 (1,742,704 B, 2026-10-25 13:10:04), 15ffc8fe82e63b40753e5847690e2c8b7e842dfbab32e9de5be1d75bb45eb176 (1,578,592 B, 2026-10-25 14:09:43), aa3e8888942a444783681cd89b4238006d0079472d44c588432f797c840e4a4c (1,872,656 B, 2026-10-25 15:09:37), 84e238337bd60e4c21a34d64fe32c6e26d1f90307d287db6734f07500ccc0e87 (2,085,968 B, 2026-10-25 16:09:45), 2ef203677f9ea44e0c843f8a284d5cb7e8b6088c221bd7e1c26baa0d0843c762 (2,021,104 B, 2026-10-25 17:09:37), 90c2184491a2a311dcef7ef2ba92430103540835fb52b42e66e32d3d30378b46 (1,971,648 B, 2026-10-25 18:09:44), 68e952e611ef142622bfce41eddd62c7153d01b9a49d8f78f00d39e1c39caad8 (1,856,688 B, 2026-10-25 19:09:37), ad407e60a93add5347ea63b7a9c2b1403d816f98cb947a17f0f835d4376b2eb9 (1,922,816 B, 2026-10-25 20:09:44), 70a8a182d334a91f5ebc60ef9956061b076ad915b7693f38c1152980a519b8f7 (2,103,024 B, 2026-10-25 21:09:39), 7fd117432a13b3a7c952a3c06a2c99eda37a5728cef8b73fc48188b7f0804c7c (1,971,168 B, 2026-10-25 22:09:43), dcde47d0dfa32797748f3abe9eac880650adf105fc97fbe2ee69e350e91cf95f (1,971,168 B, 2026-10-25 23:09:38), f83fafd19e41c7d6d97f495ed5aa2ec22e33ab0d4505e799399fff573585636a (2,069,680 B, 2026-10-26 23:09:39), 3acbdf3c42ff9d9f243f4ac5cec9e37a7fd64d21ca82acc348285c04471ba05f (2,349,200 B, 2026-10-27 23:09:48), 5937fc8d8c630e6542d920837e2aaf28c762531e6a50f0e7dc4c58167826e4b6 (1,988,080 B, 2026-10-28 23:09:44), be70832f18593e14e7e205abcb995ca2d030217a7cc6f6a37032b2c5d804aaea (2,053,952 B, 2026-10-29 23:09:47), 108619cda483784f4ad433ecd5d38730cc351667ed577a91bca3859e02cf13e1 (1,889,440 B, 2026-10-30 05:09:44), 3a9ecbef0ec6c33fc72088b0c1b5700d1c643b86e64b1df27b16478c11f7b68d (1,872,736 B, 2026-10-30 06:09:49), afc491d6de2257686e0e9bf069dd1f641960288a74b598f77de6e06d11967a98 (1,873,376 B, 2026-10-30 07:09:43), b43ce4a8b7d2ecc4662e76f593740f5d0a19d5f9a40e2a20d98e7e5f70366a74 (1,873,152 B, 2026-10-30 08:10:16), 6279362b18a395c6625fdf92813969fbc5ce26ce7207bc4c192c41caa0919f0e (1,808,048 B, 2026-10-30 09:09:44), 8314e573c905ce634606669866062b15ffc1e7d3b3e9bd47bb661fd43e5afe0c (1,693,232 B, 2026-10-30 10:09:49), 2815f2e94ce9747946a4af466389479b389f74ec353ce04bcd1cb596588ba007 (2,234,576 B, 2026-10-30 11:09:45), 77ebd7914f9d645ecc34c8c4c622c9ed1828a7d0a797652f842651e75b3319dc (2,151,152 B, 2026-10-30 12:09:52), c49cab9b80a9bd53e7eee922b04041b85991448a5420cde775aaa28f1ca3429f (1,971,040 B, 2026-10-30 13:09:43), 3b048be745247b6471a80e7189cac025cd0f7d33256e9e9ed271f968037f5b78 (1,987,424 B, 2026-10-30 15:09:46), 1418b2cf9db1233eaa52f7b5b974da685d248a1599c187f08dbc8ecff79b92bf (2,118,960 B, 2026-10-30 16:09:49), 66e1afcc6a692ff15f623e12ca746520e965ee82c080367a3eb291aa4552eeb1 (2,119,536 B, 2026-10-30 17:09:46), a549be648cce736f1bfa90e81ea64fcc1dd4bb49d50f99b4fda30e6dd8aff1b5 (2,200,640 B, 2026-10-30 18:09:53), d3c123ade69529f4f135103ecee8a1783f81aaa7b7b34a696c73144e96ac7e2d (1,972,128 B, 2026-10-30 19:09:44), 672a261b77dba6c8b8e5afda04d4db95eaa716808dc2f33d6bab4df99b9d6bda (1,725,824 B, 2026-10-30 20:09:48), 91a54143993e77430d3d2ba956e4e7a8798acb8e59d9fc4deef6119243bb2a07 (1,725,456 B, 2026-10-30 21:09:43), 0824fec1351e5a2d2e540da57d31eac50fce8863b0b2a94a267ec0e2d76a837f (1,692,096 B, 2026-10-30 22:09:49), bcb58d1ebd9853618b537785f4ee5a4953ef4dea0f722b4ccdac5aaf9e3223dc (1,971,392 B, 2026-10-30 22:55:21), d4f7723f59d5430d5a0ca7cc1d1a1d96c0cdf1e6df067a57d4b417104adc7202 (1,872,720 B, 2026-10-30 23:09:44), then this one. The delivery chain is fixed and only the payload rotates: the stage-1 zsh dropper at the same host (sha256 de5b4c6411938c0660f01d6933fd21e40ea7a2b6a141ff552d9dc39c931f6345) has carried the same ETag since 2026-09-24 23:15:10 (last checked 2026-10-31 00:26 UTC). The first build in the series was unpacked statically and held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. This build compared against the previous one: 46 __text functions against 45, TLSH of __text 158, above the 11 to 128 range measured between earlier builds of this family, while the per-function CFG match still reads repack-like. The encrypted payload table holds 108 items totalling 265,754 bytes of plaintext against 86 items and 262,848 bytes in the previous build, a 1.1 percent move: the same script re-chunked. This build was not unpacked. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a Cloudflare 520. Not executed.