MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AMOS

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e
SHA3-384 hash:	1bc871a46841015d0111fd162976dd9a0378e7f64618ebe2b9a599ccca7ac8f57c166b574f2249780c62cb5845f3d896
SHA1 hash:	c3966d289ccafeaba3d14921ad55d97e99294c36
MD5 hash:	93c40fa2bf3f5c8162ebb0dd9a0194a8
humanhash:	alanine-video-steak-venus
File name:	macho_99410c62ffba.bin
Download:	download sample
Signature	AMOS Create hunting rule
File size:	1'232'160 bytes
First seen:	2026-10-09 01:30:03 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	24576:Ah//Uihf2BLLtSYL5F8WB3IQLpOnVjtSWxV:2HUciL5CmIS+xV
TLSH	T1C9450240DFA689A6F4CCDB301E2B0F33DE2172A086C511DE62621B895D377D3F56B269
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	c4ffeine
Tags:	AMOS AtomicStealer ClickFix Foxveil Loader Mach-O machO macOS

c4ffeine

Foxveil 'quill' build Mach-O, the TWO HUNDRED AND THIRTY-FIRST payload served from this one unchanged URL (fat x86_64+arm64, 1,232,160 B), fetched via Tor 2026-10-09 00:53:51 UTC, origin build time 00:10:09, 1 hour 1 minute after the previous build 9d733d1f2fca83a4a407769566fcdf29720fb27495a4b6951bf663a5b978055f (built 23:08:45). Same loader family as the previous build by function-level CFG match (TLSH of __text 66, inside the 11 to 128 band measured between builds of this family) and a payload table of 295,863 B plaintext against 300,444 B, but the wrapper moved with this build: Build 231 is a pure obfuscation and decoder repack of the quill AMOS stealer; its cold-open EXHAUSTED only because fv_base_profile missed the PBKDF2 salt const-pair 0x34135 xor 0x34155, and once that pair was supplied the standard quill KDF at 80199 iterations opened all 105 items. The stealer did not change: 56 of 56 handlers match build 230, C2 module paths are byte-identical, and the full AMOS capability set is unchanged with no new host, path or LaunchAgent. Not executed. VirusTotal: https://www.virustotal.com/gui/file/99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e Hybrid Analysis: https://hybrid-analysis.com/sample/99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e

Intelligence

File Origin

# of uploads :

# of downloads :

230

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.MacOS.Agent-BXQ.66382826.UNOFFICIAL

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad0857c6f551121ba15db27

Tags:

trojan virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lummastealer masquerade

Link:

https://www.filescan.io/uploads/6ac843b18062210a173f8da9/reports/fec70cbd-3021-42fe-8b3c-3545b7451df9/overview

Verdict:

Malicious

Labled as:

Mac/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e

Verdict:

Malicious

File Type:

macho fat

First seen:

2026-10-08T23:28:00Z UTC

Last seen:

2026-10-10T23:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e/

Threat name:

MacOS.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-09 01:30:36 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

6 of 24 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tfaqyyx7xl3apjrmfow7kpmevzcqzmmh6ozbd64lrhowiddipjha._file

Malware family:

AtomicStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/99410c62ffba/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/99410c62ffbaf607a62c2badf53d84ae450cb187f3b211fb8b89dd640c687a4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	Foxveil_Loader_TaskInfo_Variant Create hunting rule
Description:	Foxveil macOS loader (ClickFix -> AMOS), quill generation with run-time settings back inside the payload script (no constructor settings file): fat x86_64+arm64 linking CoreFoundation+libSystem+libc++ but importing nothing from CoreFoundation or objc, with the task_info/mach_task_self_ resolver core in both slices inside a per-build random libc decoy import set