MalwareBazaar Database

c4ffeine

Foxveil 'nova' build Mach-O, the THREE HUNDRED AND SEVENTY-SECOND payload served from this one unchanged URL (fat x86_64+arm64, 1,906,208 B), fetched via Tor 2026-11-03 00:06:11 UTC, origin build time 00:02:02, 1 hour after the previous build. The origin is nginx, so each build time is readable from the ETag: the payloads served behind this URL were stamped 2026-10-16 16:01:56, 18:01:57, 19:02:02, 22:01:56, 23:02:04, 2026-10-17 00:01:55, 2026-10-18 00:01:57, 18:01:58, 19:02:03, 20:01:56, 22:01:58, 23:02:04, 2026-10-19 00:01:57, 05:02:02, 07:02:03, 08:01:56, 09:02:04, 10:01:57, 11:04:52, 12:01:57, 13:02:04, 15:02:04, 16:01:57, 17:02:03, 18:01:57, 19:02:03, 21:02:02, 22:01:56, 23:02:03, 2026-10-20 00:01:56, 01:02:05, 02:01:56, 04:01:56, 05:02:03, 06:01:55, 07:02:01, 09:02:01, 11:02:03, 12:01:57, 13:02:05, 14:01:57, 15:02:04, 16:01:56, 17:02:01, 18:01:58, 19:02:03, 20:01:57, 21:02:04, 22:01:57, 23:02:01, 2026-10-21 00:01:59, 01:02:04, 02:01:58, 03:02:04, 04:01:57, 05:02:04, 06:01:57, 07:02:04, 08:01:56, 09:02:05, 10:01:57, 11:02:03, 12:01:57, 13:02:04, 14:01:57, 15:02:03, 16:01:55, 17:02:03, 18:01:58, 19:02:02, 20:01:58, 21:21:25, 22:01:55, 23:02:04, 2026-10-22 00:01:56, 14:11:26, 15:02:02, 16:01:57, 17:02:01, 18:01:56, 19:02:03, 20:01:58, 21:02:01, 22:01:56, 23:02:03, 2026-10-23 00:01:56, 15:02:02, 16:01:56, 17:02:03, 18:01:58, 19:02:04, 20:01:55, 21:02:04, 22:01:57, 23:02:01, 2026-10-24 00:01:55, 2026-10-25 08:01:57, 09:02:05, 10:01:54, 11:02:04, 12:01:55, 13:02:03, 13:54:34, 14:02:01, 15:01:57, 16:02:01, 17:01:57, 18:02:01, 19:01:56, 20:02:04, 21:01:56, 22:02:01, 23:01:58, 2026-10-26 00:02:03, 2026-10-27 00:02:03, 2026-10-28 00:02:02, 2026-10-29 00:02:04, 2026-10-30 00:02:02, 06:02:03, 07:01:57, 08:02:01, 09:01:57, 10:02:03, 11:01:57, 12:02:02, 13:01:56, 14:02:03, 15:01:57, 16:02:03, 17:01:59, 18:02:01, 19:01:57, 20:02:04, 21:01:56, 22:02:05, 22:47:34, 23:01:55, 2026-10-31 00:02:04, 2026-11-01 00:02:02, 01:02:00, 02:02:02, 03:01:57, 04:02:01, 05:01:58, 06:02:03, 07:01:57, 2026-11-02 00:02:03 and 2026-11-03 00:02:02 UTC. The job skips hours rather than running on a fixed interval, and the gaps measured so far run from 7 minutes to 23 hours 59 minutes. Hash sequence on the same URL: cefb465886bc813ac91e9ad5b1835eefe9828f251b58eb0da012ee4022ff6d98 (1,758,512 B, 2026-10-16 16:01:56), 6d0e9b099c6fab4f8fafcf83b380df6b817df0a06fd041acd64d37a8f2cc909b (1,955,056 B, 2026-10-16 18:01:57), 3cd3cac10596820b929eda2e13a110c9734adfefab86872ee5573f4bcea787e0 (2,004,240 B, 2026-10-16 19:02:02), 01d6c151f944b25d17f351dae3be8dfb3f3d89685838646704f1eb55bd4327a6 (1,710,016 B, 2026-10-16 22:01:56), 26bdb60a09509a4747cf622cee7073bdc639f849169232294d992ebd2f38de21 (2,136,048 B, 2026-10-16 23:02:04), 21fd4621502f4fb9240b76333ed40f6097f1a4a7a9359dcc20fe198f49eee5f8 (1,972,080 B, 2026-10-17 20:01:56), 112ce65fde13d2d815eec63d35714388566009420b533603c47a7cbaeae26a3c (2,102,128 B, 2026-10-18 17:02:03), 776fd70497cb6ead54c047eaf624886de308364ff2513e9accca8bab09714824 (1,971,760 B, 2026-10-18 18:01:58), f4d558133f6ffc69d42dd5c3504938e82fe1a4ef241344f729ae22f6d200cd1e (2,069,440 B, 2026-10-18 19:02:03), c66457e25286934b41d159943f7d97f01988fd7801425d3d938823983c25223d (1,807,968 B, 2026-10-18 20:01:56), 768fb1929679a74bba202c9b4d2325c2053df6d601469bc45e5aceba87a02427 (1,939,152 B, 2026-10-18 22:01:58), b5d4aba0fe4004e851756d0329f0c165db2c1667c7c73516e0f1537c9afd3298 (1,922,560 B, 2026-10-18 23:02:04), 0b222b54a5145ae36d2de39a3e1111317538caec94ec38540f99c6d74efb435a (1,873,776 B, 2026-10-19 04:01:56), 226739b1a7de76a67811c5ad8afb146498a1c9976bd280de3d6332d89fd3bd52 (1,905,328 B, 2026-10-19 05:02:02), 23b517c5fb2177228cba15efdb1d1fb342699e8ecead5cf535b5c93ece5f41ca (1,906,528 B, 2026-10-19 07:02:03), cc8e0a9b5e3268b5de4456089df0190f02b5abf692ab91da76a354d57c9d727f (1,938,128 B, 2026-10-19 08:01:56), 60bae69ef9f63f44e992ca2eb2e1c4e07915ba6f26035fb92b64f6049c5d861e (2,120,080 B, 2026-10-19 09:02:04), 0dc2953725e217dea1476261be40b35a6117e060dd1d39be65227976e7cc67e5 (1,824,208 B, 2026-10-19 10:01:57), 0a19a893476c75cd1be3fb81836b04f23b3775272c9075298e57797a1366702e (2,136,240 B, 2026-10-19 11:04:52), ea6d22bd809f623b75fd9b203ca39add938aee4bb3e14b544292e62eb8ed422a (1,921,808 B, 2026-10-19 12:01:57), a31ed5c0221194cbcabfac8f199355a01d97f1301a56010643da88fb2ba494ae (2,086,736 B, 2026-10-19 13:02:04), f3f3a682cb0f5bb3510af445540d76ecce01bafd0f562d3e27606548f72b901d (1,922,304 B, 2026-10-19 15:02:04), 5dd04ce2236d1ddf4be2973677368781ffc61b0f48a614409aa702d66464b6db (1,939,088 B, 2026-10-19 16:01:57), 3a3daa3f6d36529eec11b00b4ef59af89f7b602d48cfa53959ce7fccf4654b94 (2,184,880 B, 2026-10-19 17:02:03), bd76eb26ff6fdc79a840971129bc5c6d1783624230382b970e7438247dc25b57 (2,020,896 B, 2026-10-19 18:01:57), d3b6ed3442f8195b3d33b5293abdc5cce173bf2528f947634773464ae931cc70 (1,791,296 B, 2026-10-19 19:02:03), 70e339bcf38b2d79774daa135ec598f2ecd99c6ec1cd9e810bbf005da9aab64d (1,905,664 B, 2026-10-19 21:02:02), 2970e8113c21fbbbadd88ffef710c891dbe76f63240e86f63eea5805db494c17 (1,725,456 B, 2026-10-19 22:01:56), eff9564d3f458884501c4f2431650a0366759489275cd26f92d1c54f43bbd244 (1,988,400 B, 2026-10-19 23:02:03), 706c3b12e8be63504ef14663eb7084a2d14587419166918f2fe32cfe55d78ee8 (1,889,984 B, 2026-10-20 00:01:56), d27a01fc7400b31811c99f467677beb2aa742bf52d23fc57faae7a276abe674a (2,266,000 B, 2026-10-20 01:02:05), 4015e605fb7ff472d208169a3b89ba16b18be92d2345dfb707985aef364f63dc (1,888,784 B, 2026-10-20 02:01:56), 7220623e993c91a35f79f9f039426863c0cc0fb41bdca2168c7402dc549d3c8b (1,971,568 B, 2026-10-20 04:01:56), d343af7c4c1407abb0ef80d35321aad8f35a78728009f03cdb3da914521ecf09 (2,085,840 B, 2026-10-20 05:02:03), ec4afc460c9825c019f1848a4cb23393104f71ad4fda1370c59a103070eb5015 (1,741,216 B, 2026-10-20 06:01:55), a60322f3d0333bce984463be9109bd2c94912bf2b62e0eff0ff9d47e1cbc840c (1,955,232 B, 2026-10-20 07:02:01), 46c0f8e63ea4dce3f6df22a662de9fea8c053584d7e44d11db2683f59aabf02b (1,642,800 B, 2026-10-20 09:02:01), d7b5aff4b659de7ae4079db09f0cb0de93bdb81ac65ee8ba515e60ed34ceabc7 (1,922,976 B, 2026-10-20 11:02:03), ae74941ad741d9d5469cffc796f68e148194d13bbcec8b347d298f595e43308d (1,890,304 B, 2026-10-20 12:01:57), 30abcd306490249f2b3a7475efbd31505cd99b708bb6afdf26479c9857d898a6 (2,003,792 B, 2026-10-20 13:02:05), c07c233b47a6c9616ac79bac29f58181e8a942bd6140c36c05833ca966f5c7a2 (2,234,608 B, 2026-10-20 14:01:57), 468e53dc05080d82bd6967badf290abeb9ed38f32e3c85d815feb2b4c55ebfdf (2,020,944 B, 2026-10-20 15:02:04), 5447c8c3af70acbe9e2429ada6655eb0cc33fbcf32288334a5132c225c5a2805 (1,971,392 B, 2026-10-20 16:01:56), 160de46f3218f2c927c5c12a121a62cb439ee03e93cfb50d14c670528d9e6c72 (1,693,024 B, 2026-10-20 17:02:01), eba977ecf26df22ad57d469bd51d64fddd1a8f86078f808f17a8f639c1270ba9 (2,233,872 B, 2026-10-20 18:01:58), d317aeb78d4abc042dca288e0bf83e9817df15e1cdaf02a4fcaada68ced7208b (1,987,232 B, 2026-10-20 19:02:03), ae745245d909dd732457c05d7e41dd5f6ec7730eac3e2fd1720a67c391b46597 (1,955,040 B, 2026-10-20 20:01:57), 558b6752b1d1afffac1f20c970ffb1148eb860e9d92be2221354238b0755f9da (1,889,088 B, 2026-10-20 21:02:04), 01ead9e3a416651fe44d9ec1486cc20e17d2e2d92be3d3c116696835b8593751 (2,184,832 B, 2026-10-20 22:01:57), cacac4a94019df736f0f13a8afdccb7de77f601d1acfb893acadbdda4e5cc308 (1,938,368 B, 2026-10-20 23:02:01), dcdceb7298ac2596f4178102867f63958ecc3e1681d9f6a5b435015794ee1485 (2,217,408 B, 2026-10-21 00:01:59), 0c2561d91a803aeee65770f079681a0de6495e5d602aac5875c0dd3391c9dcd7 (1,955,632 B, 2026-10-21 01:02:04), 7d3d696759b032b3d39fd17af783c77feafc3360a4013765521795b596b37ed4 (2,118,544 B, 2026-10-21 02:01:58), 9b6f929c97407341e0f71276e0a243da3e4d152c8e6e0f078e398d421da9a47e (2,004,256 B, 2026-10-21 03:02:04), d9a13c77484e0f62d7db9f224bc87acaa0bb8a8bbccbaaaf96738a9b8f022ecb (1,906,832 B, 2026-10-21 04:01:57), 23cf598cdd5b5246ef868b659405612f7e06db1e30199464fd279db0cbd2eadf (1,988,128 B, 2026-10-21 05:02:04), 5bf97dcc09ff96f52e5b29d3f8fd78e17a80b3662272e701be4b8df8b121e2d7 (2,185,200 B, 2026-10-21 06:01:57), 2c5035d373762bfb96044a1b3fc9fce65f38025b771103d58a8621210e1d6855 (2,086,736 B, 2026-10-21 07:02:04), aa623b8404efd74cbd149208d567228723ecd206fe3969b20d6397d576e93d08 (1,971,184 B, 2026-10-21 08:01:56), c6be00082da67699489d3d5f8b7c0f5cdcb10ef24e771dabf56896cdf9f7ee18 (2,152,208 B, 2026-10-21 09:02:05), cdf5514256a3ea4eddb4b618c26d344259578ef505c27aa23423577f64f84e75 (1,824,080 B, 2026-10-21 10:01:57), 065070b4b724e81feb94601b611e85fba0178f21e1d445ba7506c057f89fc618 (1,988,912 B, 2026-10-21 11:02:03), bc4f3f020f9e362195c7c1d55ae3a5bde09f60abe7d1e56f8b5cd9621db6fa04 (1,790,512 B, 2026-10-21 12:01:57), fbca291865b5a9659952ec3b625762e21323a54eb93022991f9a75a11de946bc (2,299,408 B, 2026-10-21 13:02:04), 26a6c4a361e59958ce51a7989caa7a15582d5bfa06e32fd39dce09a4e22ae1e4 (2,069,680 B, 2026-10-21 14:01:57), cf5b187b580a7dfa59568192c967330992315409984217e68af9d6374a6e63af (1,807,008 B, 2026-10-21 15:02:03), 3445ce80c99c9d2af195376a3ea61d369dcfbbc7045c8f945dbf6553927f3598 (1,626,640 B, 2026-10-21 16:01:55), e1887502682d689a82cc0dcec161eabd777f2bc65ab70119136adc5123e1dde2 (1,921,680 B, 2026-10-21 17:02:03), 9f1feed99d8f3e7adae51401394a98696b0f4815d390769224cea543556e677b (1,988,656 B, 2026-10-21 18:01:58), 5049d7845c6a6813702b29fe6906c1810f284068697f59806616329fd269bfd8 (1,792,016 B, 2026-10-21 19:02:02), 1a74b8729a7264325db123cb7d5bd75f75a442ffc367addb9fd958c6055e9a79 (1,988,080 B, 2026-10-21 20:01:58), 4b14f3e9b5a097b7cc3bcb1ccfd8e0d8cbf5d939b5eb48ef705263322ffd4e7e (2,119,600 B, 2026-10-21 21:21:25), 824fcb6cd0621c4b08a035c5d1f0b0e9ffb954ff8f0dc8c329cef117fada7f91 (1,790,528 B, 2026-10-21 22:01:55), e6d5a096be84b8820fd724a9363559854823cb43957578e0c563078d169c6305 (2,036,656 B, 2026-10-21 23:02:04), dccaa547f674bf3d15a38364bc1e16e63fb01d246017fbe4c3e4e0750d7ee85e (2,201,792 B, 2026-10-22 14:01:59), 7df36ff2579d16c6cdf99b98175587985648cc67b856525e2f8c881bd8229587 (1,955,360 B, 2026-10-22 14:11:26), 2e17c4ad4c198527a6d0c3d8ffe54f99f7d870ba76d3222fc6e67ed70961dfe9 (1,972,080 B, 2026-10-22 15:02:02), e55fff0beec00be42ab3894aa8fc2dfcc220815acf6c4d348af71ec1d157cc6d (1,938,384 B, 2026-10-22 16:01:57), 33e28b65459edb294dd94f60b4cc79ee0622f660e73a0eb9bc427165bbeee947 (1,757,760 B, 2026-10-22 17:02:01), d7a1d9faf0514e25191da3ec1f3b2e7f29565fdb0a527863fca057cf07f0959a (2,184,672 B, 2026-10-22 18:01:56), b12c1e108b70c973a348a3d63e03358e81ce23a157f1e2a2ecfe9d067fd158ca (2,282,912 B, 2026-10-22 19:02:03), 64357afd534b6776136688d6c4a3b9e767ea3faa0d44a7e14936afeab18f0b40 (2,282,896 B, 2026-10-22 20:01:58), df1e34c945f97ab9ec5af56e62aff3e8763cf417eee7ca8e6e9b31cc563a41cd (1,970,880 B, 2026-10-22 21:02:01), 6de646846c52db8f1fb2bf715e8c20625e95665cfbd54c152400a1e4fd2df1be (1,741,504 B, 2026-10-22 22:01:56), 00a6fd9c1f56f2277306294a3f5b134aae008b9cd7dfd9f98829c868784610a4 (1,873,872 B, 2026-10-22 23:02:03), 77a76c95b71bbb85fff71960cf1bfd1485fcd1e493e1008d08beb71900e529ac (2,037,024 B, 2026-10-23 14:01:57), 0d227dd39ec26aa41faa86cdd58c0295ddd07ecd116251597c4e960d4ad9d520 (1,873,616 B, 2026-10-23 15:02:02), f74a8a969a08f66e1b3cc8901bce576b337b2bd536c2f2dd026bde2a344216d2 (1,906,080 B, 2026-10-23 16:01:56), e309bc4eb63bb2e5a20852963ce6975add80365e33ed9aebaf25712a654a6a1f (1,922,864 B, 2026-10-23 17:02:03), 847a9f2519d075f3c1e616bb280390a1bff691a573f68edbd69c29c587fcc091 (2,216,928 B, 2026-10-23 18:01:58), be556f5ace9052310846cd29c5cd4dad3dc328009f8cf5519e9d5d26101376ac (2,037,888 B, 2026-10-23 19:02:04), 741f9b01aa5db34c0902c7bcd5d86c816c7187aebd4a4d62ef294b42cf16639f (1,857,648 B, 2026-10-23 20:01:55), aeeea08068de2839290f9cb35746268e0d27af2a474f7c0acbaf1c57449f2f35 (2,331,664 B, 2026-10-23 21:02:04), 5f8ffeeef936272c8fd3922373e7e71dde5279c6f6ddbeff0e47df76015f9e3b (2,331,856 B, 2026-10-23 22:01:57), 9df9be8bbb587de430026aefdbe30d52f9a886e8e18f32ca204a4920e49e9549 (1,889,984 B, 2026-10-23 23:02:01), c234bd9463ee5b65cfdb7db880891f8252b7abd4e510ad324089a145ce9b692e (1,725,824 B, 2026-10-25 07:02:01), 53945e1b7209aaa3c2b6d7f1c5d2524080eed4117234bd393e089c116f11dbcc (1,905,584 B, 2026-10-25 08:01:57), a823eeea0c56c87c7d6e19ccb188e12e94fc66bf193ffe2bf76957cc775af9ab (2,102,864 B, 2026-10-25 09:02:05), 6d3f62f28492c43d705d003d2274f9a391195c4ff0056077c76642585b4345c1 (1,676,720 B, 2026-10-25 10:01:54), 4a9475b8383b95258c238f1a1745f9bbc175b80f285f25ab3b34a1691715e4fe (2,233,904 B, 2026-10-25 11:02:04), e0cf02967b310e90242f89cdc8cea27d4f72a3f626570feb8bc27b2aa541a03d (1,659,600 B, 2026-10-25 12:01:55), 9ae2803392eafbd9711de7fb455b3ebc025dd9aef32e887d52a360d6e2b5ae43 (1,725,504 B, 2026-10-25 13:02:03), a3c628390cc8f4d2b66cf6c52ba63291c988cc0ebe816bca11a3f4c2e3eaf22d (1,921,632 B, 2026-10-25 13:54:34), da6c7639971c3c2687dc98f49505ab3e46ae158b91108d47298fda04509ac1ac (1,856,480 B, 2026-10-25 14:02:01), c6079476334876f81899b91ede99a2eedd84c28b700767b384576813878ef6e6 (2,020,944 B, 2026-10-25 15:01:57), a4a476124a6bbc171642c87e139d752760236c5d82a177cb853b2050b81eb226 (1,725,936 B, 2026-10-25 16:02:01), ee8d85e7debbc123da1b49c3e656c0ad90e1d14ef897b5cf0bc3304f58c8636b (2,037,664 B, 2026-10-25 17:01:57), 463c22aa0da6ac61b18936c02647d826a274328aab99282dff5d95effafa420e (1,708,720 B, 2026-10-25 18:02:01), 3aafc54ca2c123a9cbecc7317b663f786fce738d22e42edbf8f5250d8651ed3c (1,939,504 B, 2026-10-25 19:01:56), e369e1a7d9e937175c822c3ac3cd0c1d29c34d0847ca5368a62fc334092ddab0 (2,201,104 B, 2026-10-25 20:02:04), 1e70c0cd3487dca5a21f2cdae5bcb648ba6c3bafabc52ef1e06b1ee04124d706 (1,922,032 B, 2026-10-25 21:01:56), c1b80dd3cf5c227848edbb7beed4a3dab9df03819f4fcb973af47637e0188d35 (1,676,432 B, 2026-10-25 22:02:01), d72ab67e90c5ac6f37053a61b349d5be059007e29d5f27ee30223804ae209c79 (1,955,568 B, 2026-10-25 23:01:58), 5519a1ddb22e037096314252e3309160a5641c2d53f4e2b46c7babaf375482d8 (2,069,632 B, 2026-10-26 23:01:57), b890cd23bcf5af6b2f8df728cda8b79bf155e73af478a17240c6ac62f2c66b88 (1,987,904 B, 2026-10-27 23:01:57), 5bd9c4b65c17dc6a2a395d89f31ad214aadf226e7638620b5a1e6ddb19c37a91 (1,659,536 B, 2026-10-28 23:01:55), 7ae5ad123099212bbecd2f10505fcdd0c3036290ccfb843af161527cdd90aefc (1,676,416 B, 2026-10-29 23:01:55), 43acb358b169c584c34a0be5bcd579883c3ab4b54d7e3d40925864be8abda0ba (1,971,056 B, 2026-10-30 05:01:57), 339b27daeb628288fdf3b0cf5011ee2e924c8395c72fc5c2f5d8d5fae013ac55 (2,250,688 B, 2026-10-30 06:02:03), e5b6f1e98ad9fc1c31117dec740ece897ff695d14fa5d52bb82335a615bcda49 (1,954,512 B, 2026-10-30 07:01:57), 82932409ef7a8a860ff29c00ab34fa5de5d59d9465729a8ec5d24a34f57e8717 (1,840,256 B, 2026-10-30 08:02:01), 937897c9d57a4dfad555e07f2c6835d39454041d06e2df79dd85ac07d8c8d9d1 (1,922,464 B, 2026-10-30 09:01:57), 8652a6a14058bdcce5b7d367b6632ccd9b1f9475ecb820f4016776eb21455be2 (2,102,272 B, 2026-10-30 10:02:03), be6af021b7f170b9ef1e275c87eb61444b1d8eeb720931c20d4429ff7c21e665 (2,053,504 B, 2026-10-30 11:01:57), 5d560d68ca3b76d7e4995f9c49b1011abd5cc8fcb96b0e92f0fa0852af22c19f (1,792,160 B, 2026-10-30 12:02:02), 883787ece1e69fd21732004b371d36db27b767e529325c0651ce2454c045b2f5 (1,709,536 B, 2026-10-30 13:01:56), a8329eb72fac08b1b8384e6f1d98b1c1a68c13783b6a26af58f6a13fcf22c334 (1,889,600 B, 2026-10-30 14:02:03), 260be97921b48c2cc70896c88ab03ccd89a54de8d7156534fb99ae5ac05ee85e (2,102,464 B, 2026-10-30 15:01:57), 4c53559dd754b6dc1dcda06b9001cde10a27f0339ba30f495bd4d841df60ae18 (1,906,096 B, 2026-10-30 16:02:03), d04fd1021673bbf1462dd8048d4a773c6216238ad08a336978d0052a7559e2d2 (2,054,016 B, 2026-10-30 17:01:59), 18e5c46fe37fb19f9e45a5addd95be97a919272bb2df4b2385575f9bb144c005 (1,774,976 B, 2026-10-30 18:02:01), 7429a0555d38f0f76589007179be9ea9890947482276717022f99a09c3c6a066 (2,021,088 B, 2026-10-30 19:01:57), 361ce304541cd42531620d52c96a7da616f4dced8becf25d81c5175e9825301e (1,988,672 B, 2026-10-30 20:02:04), 521ab948adfe8e8f64bfd95034ff4ad0d178ba68c07fffdec693d5f74622f1c5 (1,856,816 B, 2026-10-30 21:01:56), 75c078d0a54514ac66b4a43a35fe7ab8c936d7550b103be2314d606c19cb960e (2,053,520 B, 2026-10-30 22:02:05), 2a27f51042137809d60f3e2a30c779a81c37c68dd1eaf692c04314db1ebb3bfe (2,250,016 B, 2026-10-30 22:47:34), f184f1616f31bade9251eea2c2c420bc5c7779ffd8e3fdaf7deba3fab940f89b (1,855,952 B, 2026-10-30 23:01:55), 9f2184a8312c987f06a966a3915d73080e033f7dff7ddcc2d17aa899b23b0ec9 (2,250,000 B, 2026-10-31 00:02:04), af95c361f4a077a251c9879c2cbadd1394302db083b6753bba55784d792dcc2c (1,709,312 B, 2026-11-01 00:02:02), 4fbd83da46a18926eb3007d97851fcd48b46a8fc62b8abeeed6fa94fd09a3dfd (2,217,760 B, 2026-11-01 01:02:00), 18fb2a875a35bab43bd6fa2cd1282dc93c75d2fe3ecae7607e22d8b4504306e1 (1,840,624 B, 2026-11-01 02:02:02), 97e54fe21fd19532be5e0fce1ddba25a39712cc0ff066d6c328bbb723b5bcb7a (2,054,256 B, 2026-11-01 03:01:57), 7d31c66a3956616aafe725beeb8b16c51256bd3ae08d30db4df06aafe296a3c6 (1,857,168 B, 2026-11-01 04:02:01), 48faa774ce76d14ed18a1a8cefb3edcf8474a6ce98f3425abe5d100e330dd89f (2,168,336 B, 2026-11-01 05:01:58), 890b50929c2fb563308578e9b4ce9443323a5cb9538d0eaf6968edcfb5ea6d19 (2,053,440 B, 2026-11-01 06:02:03), 4045aea019d1834b62759ffb1e0603c0998714cefcf25da06b0b0d5b038d1dea (2,037,216 B, 2026-11-01 23:01:57), 18effc9e73373ada31e668e351b59bdce478adbe37c56f5b7b796454923bc370 (2,283,504 B, 2026-11-02 23:01:58), then this one. The stage-1 dropper on this host is not on our watch list, so only the payload URL is measured. The first build in the series was unpacked statically and held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. This build compared against the previous one: 47 __text functions against 46, TLSH of __text 99, within the range measured between builds of this family. The encrypted payload table holds 79 items totalling 263,370 bytes of plaintext against 78 items and 259,516 bytes in the previous build, a 1.5 percent move: the same script re-chunked. This build was not unpacked. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a Cloudflare 520. Not executed.