MalwareBazaar Database

c4ffeine

Foxveil 'chant' build Mach-O, the FOUR HUNDRED AND EIGHTY-SECOND payload served from this one unchanged URL (fat x86_64+arm64, 4,824,496 B), fetched via Tor 2026-11-06 00:11:19 UTC, origin build time 00:02:23, 1 hour after the previous build. The origin is nginx, so each build time is readable from the ETag: the payloads served behind this URL were stamped 2026-10-13 22:02:09, 2026-10-14 15:02:15, 18:02:14, 19:02:09, 20:02:15, 22:02:15, 23:02:09, 2026-10-15 01:02:09, 2026-10-17 00:02:13, 2026-10-18 00:02:15, 19:02:20, 20:02:17, 22:02:15, 23:02:19, 2026-10-19 00:02:14, 01:02:21, 05:02:19, 07:02:20, 08:02:15, 09:02:22, 10:02:13, 11:06:22, 12:02:12, 13:02:21, 15:02:19, 16:02:17, 17:02:21, 18:02:15, 19:02:20, 22:02:17, 23:02:20, 2026-10-20 00:02:13, 01:02:19, 02:02:16, 04:02:16, 05:02:21, 06:02:14, 07:02:21, 09:02:20, 11:02:21, 12:02:14, 13:02:20, 14:02:15, 15:02:22, 16:02:15, 17:02:22, 18:02:13, 19:02:21, 20:02:14, 21:02:22, 22:02:16, 23:02:20, 2026-10-21 00:02:14, 01:02:21, 02:02:14, 03:02:19, 04:02:14, 05:02:20, 06:02:13, 07:02:21, 08:02:12, 09:02:19, 10:02:14, 11:02:22, 12:02:14, 13:02:21, 14:02:15, 15:02:22, 16:02:15, 17:02:19, 18:02:15, 19:02:20, 20:02:15, 21:21:44, 22:02:15, 23:02:20, 2026-10-22 00:02:13, 14:11:54, 15:02:21, 16:02:15, 17:02:22, 18:02:15, 19:02:20, 20:02:14, 21:02:20, 22:02:15, 23:02:22, 2026-10-23 00:02:14, 15:02:20, 16:02:14, 17:02:21, 18:02:15, 19:02:20, 20:02:15, 21:02:22, 22:02:14, 23:02:20, 2026-10-24 00:02:16, 2026-10-25 08:02:14, 09:02:19, 10:02:15, 11:02:21, 12:02:15, 13:02:24, 13:54:53, 14:02:21, 15:02:14, 16:02:19, 17:02:14, 18:02:22, 19:02:12, 20:02:21, 21:02:17, 22:02:20, 23:02:13, 2026-10-26 00:02:19, 2026-10-27 00:02:21, 2026-10-28 00:02:19, 2026-10-29 00:02:21, 2026-10-30 00:02:19, 2026-10-31 00:02:23, 01:02:15, 2026-11-02 00:02:18, 2026-11-03 00:02:18, 2026-11-04 00:02:20, 2026-11-05 00:02:21 and 2026-11-06 00:02:23 UTC. The job skips hours rather than running on a fixed interval, and the gaps measured so far run from 7 minutes to 23 hours. Hash sequence on the same URL: a1efcf4e1c2ee9a4a887ec9208a7f69c0bc360677db147161cad1e54520780fd (1,495,488 B, 2026-10-13 22:02:09), 894ae89f56f352652cdb1f9ec23ac1c31f26ea648326bfd23c871636ff66ded7 (1,494,336 B, 2026-10-14 15:02:15), 1eb66cf083f9d36b561989a45737d12f92bb0765d286e1147431f221a27ab755 (1,150,400 B, 2026-10-14 18:02:14), a77493bbb1c5e2ded3aa4f8cb7e40084d80f57e5bbe10ccb05bf78ea5371eb6a (1,315,200 B, 2026-10-14 19:02:09), e11db3bf8c3a66af944fdba35762148b825a704c4792008e93a80395e47c1632 (1,347,632 B, 2026-10-14 20:02:15), 6363fea32a30affca2ebbbcd28fe60f5f6a4122231a80b280eda6f9523be931a (1,313,920 B, 2026-10-14 22:02:15), 94fa6a971ad5f47af054b81752d471b920981b3ee4874a3823062417e7b36a9d (1,200,432 B, 2026-10-14 23:02:09), 7daff06433984f594d4cb5efda68bd08b5cb07c3542ddf72182ca18ed205b0c0 (1,922,752 B, 2026-10-16 23:02:20), f401de4eed7ab6fabe85593ef82c02183353945def29db02f4be47eadb7a2879 (2,068,992 B, 2026-10-17 20:02:15), 24969acf6859e685be371b98a62477d7236d5f85eff3190bcbc55dbe5b8c60ba (1,955,984 B, 2026-10-18 18:02:15), a65580c55059b46ef3300dd5223602f7bcc603f96c1642cc71d9bab2a5e62e7a (1,742,224 B, 2026-10-18 19:02:20), 6fde54ea9de9309cc801d48f06af383b5820b42f89bbd8df5b60e5f827fafb5e (2,053,936 B, 2026-10-18 20:02:17), 8dbaec42ed39b96b712389111e47c06ca1ea15389c34702df799c2b035adbfb0 (2,135,040 B, 2026-10-18 22:02:15), ceec6321dc3dbf2e1515bb53602bc278afa47b472f260f9bcdd109c5ad0052d4 (1,873,024 B, 2026-10-18 23:02:19), e73400a24824ebe3627a14cbed8383673a94684760dab43833df33341df85cc8 (1,971,216 B, 2026-10-19 00:02:14), dfc3bc27541d772d2dd9926cf48eba9b78cfa78b54cae93349051172d4181c8f (2,168,048 B, 2026-10-19 03:02:23), c9a6d732d0923eaee02b45f2624ea3a6420ccfe922fba1c8cf0c53cae28ae29d (1,840,704 B, 2026-10-19 05:02:19), 5d3eaccb4a1d40a4356b6585471de8b83c0655efe28a29d2e198d852c20549e0 (1,922,240 B, 2026-10-19 07:02:20), f0924944e502148d001e043b96981c621a65f0d4ea0c68cef26355936ae48340 (1,971,472 B, 2026-10-19 08:02:15), 0e2fb52e0404d2f843eae706ce4ed4f55b12e1bf1dcb9892ffcbb4f65dab24d6 (2,069,856 B, 2026-10-19 09:02:22), 3cf415543412e86455bbbf4b0f8db0108f4f64a16b0811128be96f2affd09cfa (1,610,720 B, 2026-10-19 10:02:13), 12c1d2fa6a15cad5a681c84fbf45a3ed8cd69a44cadb176ec1a1d79568982f18 (2,053,088 B, 2026-10-19 11:06:22), d764a5938a6187cc2890f36be894955ed8354138b8f7176c7f9183e3656a6aed (1,626,944 B, 2026-10-19 12:02:12), 626977f1481186fc0345d3ad0360b5dd217508385c41ad8c517152c853492d6e (2,020,784 B, 2026-10-19 13:02:21), d5717a63f255b21de9051933565f900e6b831388af10a7a2f7eb43fcea26a429 (1,643,120 B, 2026-10-19 15:02:19), 5b41847cff7b8e0dc16bdbecb4ca54ad46e507bcda63bfc1dd7f39b0075dd33d (2,348,864 B, 2026-10-19 16:02:17), bdced264364ace0be023c52332996d06dc6dc8cbd369a70f8c1bf72e85c0114b (1,955,632 B, 2026-10-19 17:02:21), 42b7725928f440519d214a8905bbf88ccc05bed8f3c80289e84ae2cf4a415b9b (2,020,832 B, 2026-10-19 18:02:15), 88ce6edaaadd692355c7a9136ec2abbf628d7298348ea899044ac6e1ddce849b (1,922,992 B, 2026-10-19 19:02:20), dcc726b0493bd2d9a06a1ebf0d0687091c2ef08b0091ea2a50da50eb1efd65ac (2,185,232 B, 2026-10-19 22:02:17), eb6025c6b535ac7073dc4840e7d1ce348c03bc03afa9bf66bc6ff56057c9fe3b (1,987,808 B, 2026-10-19 23:02:20), 407902441438f0f73a0ce5f5b89f50f9b6fcf7551a6179617fa21efac1cd524f (1,774,880 B, 2026-10-20 00:02:13), 164753076cb20daa839ed963818cd468d095fa148cef1adfa897a30077452816 (1,676,224 B, 2026-10-20 01:02:19), 9e6f74ea5ec27c36957a4392386c63e0103b2d7a8d237ad019ba1ebd19df8902 (2,234,336 B, 2026-10-20 02:02:16), 875b5653ffe2f1f3913a36de04ec3004f24561bcc94d0e450332bafef61a0a30 (2,118,416 B, 2026-10-20 04:02:16), 1d5758aba7fac0b612e2a462ce907ec432689c3a2ac9642a8bc449f057040be5 (1,856,704 B, 2026-10-20 05:02:21), 7132e9bbe26cec25787d57210c1cc8eadca2d5e10122297ca99c2951248a6ef5 (1,922,272 B, 2026-10-20 06:02:14), 7eef1f1775b28c8f597140a058cf0f06ed012b7a241e62093a427d666faac926 (1,921,680 B, 2026-10-20 07:02:21), 8f1b904e2b97c5ac9d7f9cf9c6bd481a23a577856665fafda5a7915ac7565833 (1,872,592 B, 2026-10-20 09:02:20), f3f882062273d08c9b3406a724b3e9292bd7b7c8978fd121e169f2a145bd598c (2,086,512 B, 2026-10-20 11:02:21), f7830dae736c861ab100bba227168418375ab3c9a66f3b4c9679a97e6baf74dd (1,906,352 B, 2026-10-20 12:02:14), 70d9681cc666845b6ce3e0caa21ea8249e2c8fb41e005ffb55e38449dd965223 (1,873,216 B, 2026-10-20 13:02:20), 473f690190dd8ec2d253adf5478b2030a460611b0c07ca854de60db3ef5756fc (1,889,920 B, 2026-10-20 14:02:15), e8dba4320d50775063453423e46c98dcf4196bca1de23d5bffd4a0c9bbc7785d (2,054,224 B, 2026-10-20 15:02:22), 03d2504a79533f6bc181824cee1c394d23b81394dad54087db7df9e20cd588e5 (1,987,600 B, 2026-10-20 16:02:15), c292ea73638bb2bcaea8d3f403993170517babe022ae638fe22d8c64c9564515 (1,971,632 B, 2026-10-20 17:02:22), 11cc86bffa61939210299828a2efa4d9f98d5b09c3d3c555eb9bc562c4ac898d (1,955,984 B, 2026-10-20 18:02:13), 6fdaa358053b5e7468f277afbf8e651ec33d8435c78601f477ee79e6a1513ac0 (2,053,104 B, 2026-10-20 19:02:21), c34f0d39f8ab06a257087ac6272acfc14dac30029aa58f1609ed9f5c7bd08f22 (1,906,192 B, 2026-10-20 20:02:14), 302e2722d8f679e32e7760e922ae46b887a769ed4975283946308a701f5e6748 (2,168,880 B, 2026-10-20 21:02:22), f46fa5bdeb0286137f000a6ee6ac5216fe8ccc4355a30034f9cc3062128a88f4 (2,054,240 B, 2026-10-20 22:02:16), f5c5a94b43141d6e39035a88ab7255e9ed2aa1f1e46148a605bd86506bff5064 (1,790,832 B, 2026-10-20 23:02:20), 6e7dcc1716e5a94f937f66f0796d10280abe40a11f13d2a258784468de71c478 (1,790,960 B, 2026-10-21 00:02:14), f11ac0f1e18ad18f9d034640a7c32b13e5fff1bd4245565585895c4683a1d0df (2,053,440 B, 2026-10-21 01:02:21), d772c3e79973d92ceb89a987e3876f21e336c90832adace6812f9c3f42de6927 (1,757,968 B, 2026-10-21 02:02:14), bdc543dd2998636ff7c5fd82ae1dd87a704dbed64f3b583f59d67b6b7bf4584e (1,676,400 B, 2026-10-21 03:02:19), 05e7782e6f1b3f0c951138a44b7cf15e041e4d9b794e08daa8b4be86399a55b4 (1,972,224 B, 2026-10-21 04:02:14), 172d9f591b8ae4447d9abb082e6e6e9e5ac70bb10c97d5866189a6f1012fd451 (1,938,832 B, 2026-10-21 05:02:20), 2301411c6910b146c1c6fe9fcc4c5b53bff6a9523b0f77000046288493ae13a7 (1,889,328 B, 2026-10-21 06:02:13), 384e3c28abcd489d56273c9d8e3914261c188b7c0eb22add975db92d6ea8f3be (1,921,920 B, 2026-10-21 07:02:21), 8d31f0250660fee1e936b8de6fb3d05c059a00cb2e3fcbec475e46f48444d95b (1,660,272 B, 2026-10-21 08:02:12), dc516456cfda039226ed2aff2f396acd7237cd7919def2f6c254acc0572c2bae (1,676,864 B, 2026-10-21 09:02:19), 7900010b5b5452b869970cae0c9e05201bebbb9205cb5ed528aa7159f52fdb79 (1,839,920 B, 2026-10-21 10:02:14), cda3669e0e9de7a73f518770b8f2e9a33b44b5e554298f5511057535cae502db (2,086,656 B, 2026-10-21 11:02:22), d91ab9708e5c414402d0b742518847e6a9e6ccad281154b59ca597cb7ced9497 (1,725,584 B, 2026-10-21 12:02:14), 202cd87d43a3908174e7b219c61ad3728cc6d46469a54f86861470c19677a6da (1,922,256 B, 2026-10-21 13:02:21), c6929c07a1d800613b03cd70c01bbb1c40b44c4beabc3bc789a2a0bdf07d8656 (1,873,120 B, 2026-10-21 14:02:15), 0a924c05dcab0af2933f1ade7d0d7e6519ac9e61e861b814bad89dc517b9d801 (2,070,176 B, 2026-10-21 15:02:22), 130173269fb9e8a12e6128613833019c428b9ab0dacd1bde3da8894e6f53d199 (2,119,504 B, 2026-10-21 16:02:15), 9ca3cd35792e1ce9a6c7b30331f1e54974ff8bfd583aa042dbf814a5798bd8ef (1,939,088 B, 2026-10-21 17:02:19), 8fe4a24d62a90c43a2ab9215a69c8415237a1b1265172d21035b79f83992ecfc (2,135,664 B, 2026-10-21 18:02:15), 5932dbc89b8a751e6e302a8831ef1795ac8cc4bb1fb788d56ae5962f9983e7f4 (1,807,600 B, 2026-10-21 19:02:20), df4daf40618e80dd2afae32a2fe0d46216a3b0ed4546ee0be16d200f1b148d09 (2,070,144 B, 2026-10-21 20:02:15), 39dddca8090a00d5be54b213a1cdaededfe508ab65e5012b73c3c89e6a625cf0 (2,250,656 B, 2026-10-21 21:21:44), c67191b785191ede69ace12c4570cf4a873b7ff3930f0c33ca5a28dbddac071a (1,889,040 B, 2026-10-21 22:02:15), 15c8aa29287daff51ee744c192372ae56fde3c5c7d53d36e3435925d87942f1a (1,906,640 B, 2026-10-21 23:02:20), 45d208d6763f72ec92434b94a981a6011b7e247f18a220073e74e32bb76e3d0c (1,921,264 B, 2026-10-22 14:02:15), 96ff620bae98c914a3d1062c849be2d354bf399326684cfaec6b58ec5d7f7365 (2,266,336 B, 2026-10-22 14:11:54), ff1a1b1a71f642d35cfede62352bd1224f06d119927352e7bfb59f0358336abb (2,151,664 B, 2026-10-22 15:02:21), 27baf627dcb861756232c8254b15e652a0bc2082ea57aebcb79b392517c227a3 (1,954,688 B, 2026-10-22 16:02:15), 13da6d18e6447bd5abd8fddaf9b4cddf8701b2b3e275ed5e58f434b362a22c12 (1,922,320 B, 2026-10-22 17:02:22), 7a394c5100c478a86d6c33e733437c5b2c362fb7a4deb9596399ee3b1dbd1e63 (2,069,456 B, 2026-10-22 18:02:15), a83b5279bc2d09a2466c632b6c9ea4b86fe98824c4c9238b5c94177a8f471312 (1,790,320 B, 2026-10-22 19:02:20), 65a3ff2d281d7e5564f39cb83f924bc90f58458961a1905ec8aaf6686dd976d8 (1,906,624 B, 2026-10-22 20:02:14), 55a87cc9ee966ee3a84ba86fc691f0c08190a4c6f067b350ef7bc6ac24369572 (2,004,128 B, 2026-10-22 21:02:20), f6292e5cf5f8dc2394bb4fd52be3be031385ed31d2c6d4492d58ba198e7b30c1 (2,168,544 B, 2026-10-22 22:02:15), d9e37f35d6a0874393c84d3a545d2b257f33d09d6f9c249172930b78bacf63c9 (2,069,440 B, 2026-10-22 23:02:22), 7a3517b21ef551876931c582c448d1352e5e98f5410e4ccfd06eb4b23e88ce70 (1,922,672 B, 2026-10-23 14:02:14), 7da4dcd0ee0bfb4e840a37d9828d3e7ce79a3ec2dc478a455e3d0cc74480f209 (2,201,408 B, 2026-10-23 15:02:20), 70dcd7aa12b06a4de2981cd3ce00543599a6533b0a0f5f5f7e01bb923cd68738 (1,890,368 B, 2026-10-23 16:02:14), a00ed4ce15f96453e8c09d340b013898a15a0ab3e8dca2aa6d4d8831bd8f2ce4 (2,201,392 B, 2026-10-23 17:02:21), b6881d5559f5e63044cc9b71bcc0246be43a61bd0807eedf16aa3fd810a6d523 (1,988,832 B, 2026-10-23 18:02:15), d6635b968b031cacbc4f9c640d401c21bf3f8c1780643c83d2f1200c5ca0d1c2 (1,939,248 B, 2026-10-23 19:02:20), 61be5de0fab0ecfc1fb0b97f582001b409c48782ef5a047362c54cfdfe122a3e (2,005,376 B, 2026-10-23 20:02:15), 3e868befa89ab3148dc90272ee768bff48e0e1a8571c316946c66e3970d42476 (2,119,760 B, 2026-10-23 21:02:22), e4771d50991d2f6b74b1a4718be9d1343a0c3cec5d56fbcd2015891c34e0ebe2 (1,807,552 B, 2026-10-23 22:02:14), ff290d19e4052db8b664031aaa873a7266c5391aefbd4204f74f9a88e3b00b08 (2,251,344 B, 2026-10-23 23:02:20), 7e8662369e9f45d390b79906bd08afa980e62107d53c078b0915af43564e5472 (2,201,872 B, 2026-10-25 07:02:22), f8a9fe37b1b3e5e5fb152666bf0560eece46fa31730c5f05a124d3e4695c560a (1,939,024 B, 2026-10-25 08:02:14), abe4ec51f38bea764b50e976355bbeeabd49674f59643f0d90fd05128c39bb10 (1,775,056 B, 2026-10-25 09:02:19), 65d805e16afef6ff24e5c5740a7fb7af7b6a75a792b28f6e01068670a4020b17 (2,102,368 B, 2026-10-25 10:02:15), 5db67a8c5da7664bc8facd9d1e287e03b5eb77aff9c58a27cdfb5e231b31b1fb (2,332,528 B, 2026-10-25 11:02:21), 5fde1635dfbd522e9dc564ab7c837e833020f06585ffa6e6084706ba3a536b5a (1,938,496 B, 2026-10-25 12:02:15), f2230b4a7b5df393645a299be0492ee8ceb4d82e142c948f8dbed83a9ce25591 (2,102,992 B, 2026-10-25 13:02:24), 6d330ef93ac7fade22be9a1bc846aaa8f9b4d305c19656668ca4b27a965abf27 (2,168,960 B, 2026-10-25 13:54:53), 1ee7f76b2630711530a546b5d7c5f8c6c83e2b035429ede99d9c98f24e59c672 (2,151,952 B, 2026-10-25 14:02:21), 4e05d67637704d0637405ca616abfa52b8c67696f1ae3d8ed59ddd0665585078 (1,856,848 B, 2026-10-25 15:02:14), 4c3ceb8e45425c0e9701c67352bf5f7bfc1302405978bae93db16aac5bf9424d (1,807,248 B, 2026-10-25 16:02:19), b7d58c01db3bf8b99559fb356c1430c9ee38fd60944644df5f1e8a010cd731e6 (1,841,120 B, 2026-10-25 17:02:14), 33f35b6e9e37b7cbd5e165f99bd8c95054996e3ccfa1cd95c736f925401f01aa (2,234,080 B, 2026-10-25 18:02:22), 280d39c936aff00cc50ac85c872e0fc46d1496ce22c46e00a1fb01d860c595fd (2,021,024 B, 2026-10-25 19:02:12), 71c002bf166b0bcd1c103c99c79344aefc87639062ba07e8a30f38f9cd0f45a9 (2,168,272 B, 2026-10-25 20:02:21), 4f1a50a9440b626dc5cd6247bed4284b412f470cc5a8f19bc398bbb799074e2b (2,347,920 B, 2026-10-25 21:02:17), 67bd7061834286bce9f09f23e5429fb5956880989c2c127b338e04f4b7e65dd7 (1,840,800 B, 2026-10-25 22:02:20), 9905aadc411eb351f590ab9e29fb1ba004cf61932584bce939b222de59c05b08 (1,742,448 B, 2026-10-25 23:02:13), 72b5c11c3c5f59ee3dda2e4eb1088c898b258023cded09ac4d72c70a15f62ebb (1,938,752 B, 2026-10-26 23:02:13), 69a98e2cb7d03468c9a4915eb1bbbca7f51b2169335389161ce18d1f70b6314f (1,774,736 B, 2026-10-27 23:02:14), f1af4ed428a948ca8631556a62c6a88e882be1d9e481117e2f76ed5a30a74c75 (2,036,928 B, 2026-10-28 23:02:14), 68b1a3b00dcb3fd6601d30a3b7242d03e586d15d694abec2a6e426d38454ebeb (1,790,352 B, 2026-10-29 23:02:13), 1cfa88d98876f84f071d86ea667a1d5e75bb87773625a33e13a4c48e5b4dbdb9 (2,135,600 B, 2026-10-30 23:02:16), 78d6225c51196b7016f71d18ed829cd781344de233b507630a1d804091c349d9 (2,266,992 B, 2026-10-31 00:02:23), 777dff4579c27c6a60bd2f14981a01ce5502378fe9cd5ad98a027a20d0c5697b (2,151,392 B, 2026-11-01 23:02:16), f40c85fff4386fa3edcba14d0138a308d3b9d2d4aff00f98ed765b1f1fe55473 (1,790,736 B, 2026-11-02 23:02:13), 79da9e7ccf5fcc722561d6dc02b5bcc547c640730283ff72752f02d11697c06f (1,824,080 B, 2026-11-03 23:02:15), 1d0ce3ecfe21cc5775abda12de91224a4e4a1da4599b3680bd16024146f6d621 (1,775,232 B, 2026-11-04 23:02:13), db40b38fd4e9922b51b30bb4cd4613c1546f07a8e6d0c0e902e566abc55c1494 (5,743,936 B, 2026-11-05 23:02:19), then this one. The stage-1 dropper on this host is not on our watch list, so only the payload URL is measured. The first build in the series was unpacked statically and held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. This build compared against the previous one: 46 __text functions against 46, TLSH of __text 98, within the range measured between builds of this family. The encrypted payload table holds 96 items totalling 263,954 bytes of plaintext against 101 items and 262,258 bytes in the previous build, a 0.6 percent move: the same script re-chunked. This build was not unpacked. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a Cloudflare 520. Not executed.