MalwareBazaar Database

c4ffeine

Foxveil 'cc2' build Mach-O, the NINTH payload served from this one URL (fat x86_64+arm64, 904,256 B), fetched via Tor 2026-09-20 20:46:48 UTC, origin build time 20:05:52 UTC. The origin is nginx, so the build time is readable from the ETag: the payloads served behind this URL on 2026-09-20 were stamped 07:02:41, 09:02:47, 11:03:28, 14:01:46, 15:02:41, 16:02:02 and 20:05:52 UTC. The first six land in the same minute of the hour, this one four minutes later, and the gap to the previous build is 4 hours 3 minutes, so the repack job fires on some hours only and its minute is not fixed either. Hash sequence on the same URL: a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9 (987,264 B, 2026-09-18), ec780ca8df9d10df905f3f77641f88ece7651303843802c37a57c484c6251a42, 610ae82d0d872334ba68718030bdeb0c2d23ce592b4c9022fbb225b0208b884a, 233fd2c05865e6fc7034e61bf98e64f7afeb24c1b3e88539895eeff764ebb740, 336f4bf8eb4d76c91f936beabe3a061b43db46d2cc85e6dc82dd22f9194191fc, 8e7d88f5adef0f2706fbc6df433e3c76d81c4b799389319e60a4639fc1c088a1, f03b8beef33330786b3f3f12e2bf2c352d4f14b8e6d5a78180205c7cccdcefb7, 6f994814774412107510aede65422e66c1e825f57bd3ae5d0f173aa2c54893d5 (970,576 B, 16:02:02), then this one. The stage-1 zsh dropper at the same host has stayed byte-identical since 2026-09-18 12:56:51 (sha256 6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7), re-checked at this fetch: the delivery chain is fixed and only the payload rotates, which is why every build in this series arrives at 0 detections. Six earlier builds were unpacked statically and each held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. This build carries measurably less of that wrapper than the previous one: 39,723 arm64 instructions across 40 __text functions against 53,389 across 42, and the file is 66,320 B smaller, while a TLSH comparison of __text scores 89, inside the band measured across every earlier build of this family. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a 16-byte Cloudflare 520 on every path including the root. Not executed.