MalwareBazaar Database

c4ffeine

Foxveil 'frame' build Mach-O, the THREE HUNDRED AND THIRTY-FIRST payload served from this one unchanged URL (fat x86_64+arm64, 2,152,032 B), fetched via Tor 2026-11-02 00:03:56 UTC, origin build time 00:02:17, 1 hour after the previous build. The origin is nginx, so each build time is readable from the ETag: the payloads served behind this URL were stamped 2026-10-17 10:02:09, 17:02:15, 18:02:09, 19:02:16, 20:02:09, 2026-10-18 00:02:07, 18:02:10, 19:02:17, 20:02:09, 22:02:07, 23:02:12, 2026-10-19 00:02:08, 05:02:15, 07:02:15, 08:02:08, 09:02:15, 10:02:07, 11:05:52, 12:02:09, 13:02:14, 15:02:13, 16:02:11, 17:02:16, 18:02:07, 19:02:14, 21:02:13, 22:02:07, 23:02:13, 2026-10-20 00:02:09, 01:02:13, 02:02:08, 04:02:08, 05:02:15, 06:02:08, 07:02:14, 09:02:16, 11:02:13, 12:02:07, 13:02:15, 14:02:08, 15:02:14, 16:02:10, 17:02:12, 18:02:10, 19:02:12, 20:02:08, 21:02:14, 22:02:10, 23:02:16, 2026-10-21 00:02:09, 01:02:13, 02:02:08, 03:02:15, 04:02:08, 05:02:15, 06:02:08, 07:02:16, 08:02:09, 09:02:16, 10:02:08, 11:02:15, 12:02:09, 13:02:14, 14:02:09, 15:02:17, 16:02:08, 17:02:16, 18:02:06, 19:02:15, 20:02:10, 21:21:36, 22:02:10, 23:02:16, 2026-10-22 00:02:11, 14:11:45, 15:02:13, 16:02:10, 17:02:15, 18:02:07, 19:02:15, 20:02:10, 21:02:15, 22:02:08, 23:02:15, 2026-10-23 00:02:09, 15:02:15, 16:02:10, 17:02:15, 18:02:10, 19:02:15, 20:02:10, 21:02:16, 22:02:08, 23:02:14, 2026-10-24 00:02:08, 2026-10-25 08:02:08, 09:02:14, 10:02:08, 11:02:16, 12:02:10, 13:02:17, 13:54:47, 14:02:17, 15:02:08, 16:02:14, 17:02:06, 18:02:13, 19:02:07, 20:02:12, 21:02:10, 22:02:13, 23:02:10, 2026-10-26 00:02:13, 2026-10-27 00:02:15, 2026-10-28 00:02:13, 2026-10-29 00:02:14, 2026-10-30 00:02:12, 23:02:09, 2026-10-31 00:02:14, 2026-11-01 00:02:15, 01:02:08, 02:02:15, 03:02:08, 04:02:17, 05:02:08, 06:02:16, 07:02:08 and 2026-11-02 00:02:17 UTC. The job skips hours rather than running on a fixed interval, and the gaps measured so far run from 7 minutes to 24 hours. Hash sequence on the same URL: efc0f30e9b1c8e4b1479006ecdcc95d5d4fa0627af8b294a6babe57da17b58d3 (1,971,168 B, 2026-10-17 10:02:09), e6b9564cb4d675439cf08d0e16f997e7ccaed8f9b2021170ce8f1354dcada775 (1,873,168 B, 2026-10-17 17:02:15), 29db561e83c9f2d88fab3b27f1c156a0c95481bb3c17fe0a357878ae599f8523 (2,070,720 B, 2026-10-17 18:02:09), 5e4af631dbaf78d4ec26d83923b281a8877b9b5ced30fe79f34bb62ded7511f4 (2,103,040 B, 2026-10-17 19:02:16), 5be067bb27c2387242d019b646823fd30593ca8c12319fee316fd105aaf0560f (2,036,576 B, 2026-10-17 20:02:09), 352ffb415be0af66eef67b52b58d40b571731eae62c2082a8a1968e5fe691669 (2,070,320 B, 2026-10-18 17:02:15), 49e5d9301ec4b2646c9d0a20a1abdf2012dbdf0b27a3703a96edcfe6d675386e (1,955,808 B, 2026-10-18 18:02:10), ed8bc2b4ab3d52999ecd782cddc6b43fd87a07c086e1a1285ac44a70ee55603f (2,152,496 B, 2026-10-18 19:02:17), 597dd4fff251b3f37645ad62ad3f55501e276f92c6e1c4ff0cc0da2a2af2be92 (2,086,912 B, 2026-10-18 20:02:09), f50843c01ba9df306195220951c450a19d7e45ea4d8de1e6e236378f993dbc39 (1,807,584 B, 2026-10-18 22:02:07), c38331101cf07b7fa2e38b4792752797e62fd16b86eb57192a06e4eae21752c2 (1,742,368 B, 2026-10-18 23:02:12), b5052707fbecd8647b4f13026df1b0cb8b54b7e652d517d14aa418e9c241b7d7 (1,710,016 B, 2026-10-19 04:02:08), abceffeeb0d5c7e572763b6b7e7136ee1a8e10a6cc3c7e45d2f321196d65770f (2,168,240 B, 2026-10-19 05:02:15), 8307fed342006ade508c2b883ee7b646afc80e6866ad5f91bcc79c7396995184 (2,053,856 B, 2026-10-19 07:02:15), 1d29cab44ec5ea5ad52581a71bfb5b1aae2faa8be991a67956b9b8afdc4660ac (1,955,168 B, 2026-10-19 08:02:08), 6190326ce3efab6fb4f8084d58dc406dbba7301b675cb6038ea2610ff5af773d (2,135,216 B, 2026-10-19 09:02:15), 1b09e3d4b4bd9dd016a6c5f70058e064bc94d363a245d8ca802416cf27cf4d08 (1,824,112 B, 2026-10-19 10:02:07), 550c73c949cf8d4c807561a351aff9cd29fc337c4564c4dc9aef46c58d127aa4 (1,906,720 B, 2026-10-19 11:05:52), 14b66ae83d87d0ee0119be181af7b31a3a635a4c6cb9a4e28625de1e081e0ffb (1,775,120 B, 2026-10-19 12:02:09), a54a74a4a83f4985581b83d1d23b923f13f65622dcfccd9cee1a24e1e54d704e (2,070,304 B, 2026-10-19 13:02:14), 59a291639201ae60614e01eaf86963e9c6dca8462ec2f260239b904f54007ba1 (2,037,680 B, 2026-10-19 15:02:13), c430f199f0942ea3ec8111183707e2d06be074d913aef8f48dbba6cb387bdbca (2,283,296 B, 2026-10-19 16:02:11), 11484bb1f1d41ba4a2dd18b15f519663c973d11efad02d76ba71a30bb095187d (2,152,528 B, 2026-10-19 17:02:16), efe8d5bcbd743da6c09c87f0897d78630f087cc1347cb6d4796d3e81d2d00c22 (1,659,680 B, 2026-10-19 18:02:07), 36e8a6ec8e4a8bd397e51e55b9fc970d9a3b768fdd66e6b89913492ccbc6023e (1,971,904 B, 2026-10-19 19:02:14), 28b34e7fe74ecf775a5b15fe1e75a22138d9c68829156c134b19d48e568f2046 (1,889,824 B, 2026-10-19 21:02:13), d5be1603c8a1fc0c0984d4ecb9e4d74b488bc79ad058f4606809c284a937368c (1,774,880 B, 2026-10-19 22:02:07), f34500a7e65e36f852c2e53f980bd66d8390b16472082ef231a00195ea364709 (1,840,800 B, 2026-10-19 23:02:13), 392070b982e06331e6daaa38cc8bd713b6f47b5f884d2973a908b6190cf44d90 (2,152,000 B, 2026-10-20 00:02:09), 48b459aa71abce3bced9fc970e798f5f4652b3771f1db6e5e454596f3261831f (1,954,224 B, 2026-10-20 01:02:13), 3783de51bd31420e5b2544e052058efe6d3330938831523e454856c257fef444 (1,921,968 B, 2026-10-20 02:02:08), a826a65769a7f599aad01f0d2022ab969733e04be9d1134face4cba818e730fa (1,872,528 B, 2026-10-20 04:02:08), 4f5df844bce06a3a66e303e877a2c4a116895199a55a4e370096a8a09035a658 (2,021,104 B, 2026-10-20 05:02:15), b524ef748173e2e69771e66a266033dee4476287e86080abf752d0ce12b7d664 (1,906,352 B, 2026-10-20 06:02:08), f000b4e228b5210bcbf558478cf19e477393248f10b37f62893372e5faccb975 (1,939,328 B, 2026-10-20 07:02:14), d3f3f3d8a4a8a1e5973646bfb2f0f09c899d8fc6530bc67ab509e62002e11deb (2,020,784 B, 2026-10-20 09:02:16), ca5fe22a25ba07d8d233e9fd45cd537630e76227654e8db3a9f631b45fa8efdd (1,709,264 B, 2026-10-20 11:02:13), aa91f49965bcf705f1f6912614ef0c2c5febbf00dcd08309e8a151c8be274ce9 (1,692,512 B, 2026-10-20 12:02:07), 3986810671e08738037a4cf966b01ccd52df4eb4a3761a8bf39a50db7ab24bd7 (2,069,904 B, 2026-10-20 13:02:15), 390551f7c71fbc986a7d37351801a3b31c182a6103b7370c6e64ff27bd763ad3 (2,102,880 B, 2026-10-20 14:02:08), 4f3068901819f158b50e47646da88f6464f7060c72163eea32fd1770e67a397d (2,019,920 B, 2026-10-20 15:02:14), 7d23121cdb2facca966a8abdd485e672a6ddde8c9b31b593b103eb66acaf37c2 (2,021,072 B, 2026-10-20 16:02:10), 3ff12a67ecd1a34c50ae5aea1122fd6114cad70622576ab1e1e1fa2c8420c84b (1,856,800 B, 2026-10-20 17:02:12), b43704c7b3626b2bd6a385fa53cca430efc1ccc6e52a24b8f6a24a6cab1ced7a (2,020,928 B, 2026-10-20 18:02:10), 3adc58de646efb487121248f127e51777ba433ba487fb859aba7997b9548b843 (1,971,360 B, 2026-10-20 19:02:12), 7fc348439fce7a0d6288edb1d60299b060011a49539ef955d57fd0fc2e0085cc (2,266,864 B, 2026-10-20 20:02:08), 19459527965033538912c33d6d83f90502b807b8374c2ce08d929f07821bd214 (1,938,720 B, 2026-10-20 21:02:14), 9994580d4550dc8809c8562f0c1e9b88dc88801c078cfe919c1b0a8de108dfb1 (1,938,768 B, 2026-10-20 22:02:10), 6f1a7a90cbd7a7bf70d9e85cd2d465bcc2018b1a895148ea82d87caf69360b96 (1,906,112 B, 2026-10-20 23:02:16), 66a39ad4e53d93de95c3db38822fb265dcc8835328d591edaf3bbbe5098f391f (1,790,864 B, 2026-10-21 00:02:09), e0cbbb7b6fc9f836002dc5bef368f7c8a3b70675109d80674b7c2d25e9dadcca (1,693,040 B, 2026-10-21 01:02:13), f2f075060640438586b155a4a07d5cc2f4ea297a9bffa12e091da09ef7e1856d (1,792,192 B, 2026-10-21 02:02:08), 03cbd76b6c3aea11ca539ae2bee8f73f194da17410aed505c3a5c13cfa1f2351 (1,906,400 B, 2026-10-21 03:02:15), c5bd449668102c0e01da1394d924d61e71b8e166a03c98b22d26c10cdf9b98ed (1,856,368 B, 2026-10-21 04:02:08), 10465f4d107381c851fc9ba72b76e58daec9dde092f4b7b34c440d6ef6969323 (2,003,600 B, 2026-10-21 05:02:15), 85920f9aec60f4ec3a12fea2cfa31a8825cf7fd8bb99efcf064f5be0224d2446 (1,857,088 B, 2026-10-21 06:02:08), abbe29b89a15608264813792f8a19c460145376d37db9040404b1acbd92db626 (2,004,496 B, 2026-10-21 07:02:16), 5693e033ffeba478bb45410473fd21ad8db7c77abb2c3170ffd3a846c335d1f0 (2,021,024 B, 2026-10-21 08:02:09), a05413e03e7662d2a1cc58434fdd41c6e6c47417093c0a3b48b140b3904688fc (2,183,568 B, 2026-10-21 09:02:16), 151073a0b074d35813994d041725e0623476d699c266196fd3128919f2b9c8c1 (2,102,080 B, 2026-10-21 10:02:08), f177a32b795577319de1c213d24b6f5f879cf5d081c7791264bccbd4878589e6 (1,839,760 B, 2026-10-21 11:02:15), 4ac83d57beea52283ce42318ab935b92dcde57fb105689afe9413fa0435ca071 (2,085,680 B, 2026-10-21 12:02:09), e75aa9ea21c1912a6409fe9ad46b09d45bac1836203732f024f8af16adc5a1a6 (1,758,128 B, 2026-10-21 13:02:14), a89c00be69c42fb652cba7e1821d0103cccf284e2b1f510a493f92b093ccc6c3 (1,791,856 B, 2026-10-21 14:02:09), 2d477121b1e0442fda34d5aa1e3ab5510d519a8cfb0ee3557f43f6b1f9bc346d (2,086,864 B, 2026-10-21 15:02:17), bc2411879e3d0b8b6f5ddc63cb18b8cd44ebe7443abd9950f1d016cbeb37c494 (1,873,552 B, 2026-10-21 16:02:08), f30121f927c1c3ce76f81047f49c6d88227b256d204d9a5f3a0e10d29c60ab5c (2,168,016 B, 2026-10-21 17:02:16), 6e000647ba6f7e7d134f1dc83b227eaab0f386e768c03b59619b869a7dcea51a (1,873,296 B, 2026-10-21 18:02:06), 308268425153ca593d763ec62c74aecf18df6245e097df64e6b829c94ba20bbf (1,857,232 B, 2026-10-21 19:02:15), 0834263e973be2f343c4f41b81cf68fa8518bdf054a3e1c11a60676e357a583a (1,889,312 B, 2026-10-21 20:02:10), 847f05497bf5f5b7bfb96255f5e6f1ad195d762c35586f1da19569a727e642ab (2,069,856 B, 2026-10-21 21:21:36), 143056f6280c31b4c6cdb1816af7ca60445b6017b9acefb854c518ea251db54b (1,905,344 B, 2026-10-21 22:02:10), a166456532f7e7ac79ac35d37ab1103a8f5bc976c1e627678cf6d06add9325d0 (2,135,392 B, 2026-10-21 23:02:16), 946f0a354bbd06c0b882982a8058578f28a64a48a878d53bddba8540f058bd26 (2,202,032 B, 2026-10-22 14:02:09), 890c41a8ac1dda3b84c0719f8f9cbe34375d95147bffcce9acb9cf7d3b51437e (2,086,192 B, 2026-10-22 14:11:45), 1ef5ff00d19d1536a8a0e1676be619af49b001cdb0fab27edecde5d6f7a16549 (1,873,680 B, 2026-10-22 15:02:13), 54509f5dc0d07cf1bf8b76f88214bb53b3ffa35aa38bf72246ef3c9076e96bab (2,398,304 B, 2026-10-22 16:02:10), 5bfd2e082755a8b66eda8653a0c30f7fb694ac803cc00f6c9e991cdaa9a27c19 (2,283,728 B, 2026-10-22 17:02:15), 89e304b9593074509ccdcf3adee8eda9e3cd5f226565499b995a9a3dfe95a597 (1,807,632 B, 2026-10-22 18:02:07), ce53e6cea11c849df51aa334c4d5ba14e1e7f06c4fa5d7d9aa532ff69f68ce35 (2,004,528 B, 2026-10-22 19:02:15), 79cdd6470d3814a1cae2e75f3ef3677c29988bc199fb9c056a24fd5d8648a0ad (2,086,816 B, 2026-10-22 20:02:10), 15dc5eecd0e6f47bec4e8243bbde6b08228f256a6a21d2129007bd1b00dd0987 (2,086,704 B, 2026-10-22 21:02:15), f7f318310fe622b3c55daaba6b440d2949ea7d7c35aa5fa86eaa75967f58fccd (2,021,472 B, 2026-10-22 22:02:08), d6e5854a34e317065a1fc05407f66cd88ef034bafeba5c1c0ccdce19e1c94fb2 (1,890,016 B, 2026-10-22 23:02:15), 00da4b819c4a2c1fbf30b3ccaceb7371bcd86e25252b49fdc7e71ad083691635 (2,168,752 B, 2026-10-23 14:02:11), d809e9373dc7b1ccd98fe5dbb75f3d421bb623f2ae1d5e087c70f1b5b2cd1247 (2,053,952 B, 2026-10-23 15:02:15), 9dc7dbcaed3ddf341e3d7620e12179f32260eeab0a223da50014b8f1defdb78f (2,201,568 B, 2026-10-23 16:02:10), 478594380a1651679b600f7dba0dc943fe85e2b875b2fdbe8f16696b7c727bf9 (2,184,896 B, 2026-10-23 17:02:15), 8f8a5b206c21e16f0069c8c86df18cd09ca73861751d397f3f69b052e001ea62 (2,103,232 B, 2026-10-23 18:02:10), 9fc17916b1daf376052c71cfd09df131c72bf8b2690d8f21000373bdeec111a2 (1,856,880 B, 2026-10-23 19:02:15), 3a8d0583c9921b934e576d99b8bd9d84b3b06236a8e7b385b509116656165d56 (2,070,128 B, 2026-10-23 20:02:10), 6c5ca77da71187a3e529139ebc64c031150d5020770b1bb688277e654839c225 (2,053,600 B, 2026-10-23 21:02:16), b1ba4a08538c018d9ad84617cbdbefb3684111cabd20563d911145028dbaa635 (2,004,672 B, 2026-10-23 22:02:08), 583e97200fc110eb65e7ba16cbe94c593b7ab0a21c87b8ac61e08656a8af116a (1,988,048 B, 2026-10-23 23:02:14), 08a16332b97d4ee049f0a0eadc5cbea87e16f4a419a9500362f0e92901f93fab (1,856,272 B, 2026-10-25 07:02:14), 1cca4154bff749992d0e8b7255038242840c7a06744a4280a6cbd168b8d0a48c (2,053,264 B, 2026-10-25 08:02:08), 1a1bb5d172553a78f4149c581509207eaa0838fbc66e456039d1ff4b65c0eeaa (1,856,384 B, 2026-10-25 09:02:14), ef56458f390940a3c63f3d342feeb229822d013a4f91a210cbf574f959707d4b (1,955,392 B, 2026-10-25 10:02:08), 56f93ef29a0abc0cc40b795f72486a138853d0cfacc7ccf543f106b7f6c5bc7d (2,119,616 B, 2026-10-25 11:02:16), 2e7095e944c754c7d5ca6f7b64bd7969d3d73b8995761cb1179e226a7d59535f (2,004,688 B, 2026-10-25 12:02:10), 588bd3b0467b84f5fc70689ae501f1f6ea06832b736274ef41d1bfac1eb5c499 (1,937,952 B, 2026-10-25 13:02:17), edfa7d215992e311d3d0957785aed918995b7db10cce06407c453736ac8c65ff (2,184,976 B, 2026-10-25 13:54:47), 489531e7cb0cc2b6a6c6331ecc4a74d0229f160760324aa3ef30a463c1ac1f1e (2,299,664 B, 2026-10-25 14:02:17), 723018cc70a8004acedea85ea002c6823477585565367c8808436edbe16be9f8 (1,938,384 B, 2026-10-25 15:02:08), 56a541384928ded226dba07d66cfd454a0f7387c3c790560a9d2949fd9385670 (2,053,440 B, 2026-10-25 16:02:14), af5be90a7a98c14a2b8eb8db717f6d9e8aeaebd6f8995d16bec962d42d35e9a3 (1,742,400 B, 2026-10-25 17:02:06), 66ff5d90f22a01088b5bd68710da2d14851d923d81759984520e9474913a76de (1,790,800 B, 2026-10-25 18:02:13), 73e7697a97539d67adfdaf39744be39664ac77279c2b8ae6b5c4b75d2ab2a7d8 (1,988,480 B, 2026-10-25 19:02:07), efd9fc2b6837f0208840a8f789e85260cf22963b16d7b2713771740cb8b25ef3 (1,693,552 B, 2026-10-25 20:02:12), b495be639bfc38588925bca30d751a8ef868e7a51d3c32e0f0b7149fa0c6c02e (2,119,792 B, 2026-10-25 21:02:10), df523fb9205c6267aa125068a1ea14efe825da6a57ba9db32cd0eb3d1557fb32 (1,775,504 B, 2026-10-25 22:02:13), 7459766fcc66151660f6a2cc92f13b8b800a65c6eef0002b3043979093ae5a30 (2,299,472 B, 2026-10-25 23:02:10), 4725b6bdffee4b81e80bcc9ad5d9bc6e428b558f183ce1848c47f9f9d5129880 (2,267,088 B, 2026-10-26 23:02:11), 1b06e1ca8ed325aa736361e31e55cfbc41532ec2b7452e9d9290c3931e23dee5 (1,725,632 B, 2026-10-27 23:02:07), f78c685da97bcac521cc09d3e8dfb5c049b9f33c0dd75a53704218be06fd021f (2,053,360 B, 2026-10-28 23:02:10), a419b103d9c5df9bafc12c611b200b2be3847b4d6b28d9790855b9bae1fbf551 (2,102,576 B, 2026-10-29 23:02:09), 4d67f60c04e326df14f3c45ed52658e62cd7c94f6d897c294ce3269bce369fe7 (1,840,368 B, 2026-10-30 22:47:44), 2b2d09fd9fcf70d5f0dafe9e4d791be5d7a828fd653229010f86f3701cf6625d (2,003,568 B, 2026-10-30 23:02:09), 38d02cb2cafdfd525d8dfe1cefc24e55e2a62991f9b14a94e5c11b13dede2c9c (2,102,848 B, 2026-10-31 00:02:14), cd3569812aefac3396be7f11124c068e200dc83e7882832adf9161e7b2656f75 (2,053,536 B, 2026-11-01 00:02:15), fff3271af5dc2b0402172553ab45f5da0256ec7902908bc80222805d5d6894e0 (1,741,840 B, 2026-11-01 01:02:08), 31df41fc9c5d09f3c3d1aa9efaaa6abb10bed25ab8e63cebbdb8fa61211b90c5 (2,053,536 B, 2026-11-01 02:02:15), 11fc1065fdaed923ab945159d7971e293cede5c43a993821a0df99447dd10b39 (1,808,176 B, 2026-11-01 03:02:08), 1138b968dd546228d28600e88021576d906c2cf4b52b5adc7729ee2e0206b0e3 (2,086,384 B, 2026-11-01 04:02:17), 836d1e67a3ce583cc24b7e4f314a075d172179004226625369e48981cf70e2bf (1,709,904 B, 2026-11-01 05:02:08), 0ba0c383ca5657c913c9e55e7bf8ef66d2f98960df29db993419d4dbf4dfbe5f (2,004,752 B, 2026-11-01 06:02:16), 707e6cbbd1f312fac8966581b4e31493b4a598ef40367d921a7997925792a08a (1,758,912 B, 2026-11-01 23:02:08), then this one. The stage-1 dropper on this host is not on our watch list, so only the payload URL is measured. The first build in the series was unpacked statically and held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. This build compared against the previous one: 46 __text functions against 47, TLSH of __text 69, within the range measured between builds of this family. The encrypted payload table holds 60 items totalling 266,444 bytes of plaintext against 75 items and 263,406 bytes in the previous build, a 1.2 percent move: the same script re-chunked. This build was not unpacked. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a Cloudflare 520. Not executed.