MalwareBazaar Database

c4ffeine

Foxveil 'cc2' build Mach-O, the FIFTY-NINTH payload served from this one unchanged URL (fat x86_64+arm64, 1,036,144 B), fetched via Tor 2026-09-24 10:25:58 UTC, origin build time 10:04:39 (nginx Last-Modified and ETag), 2 hours 2 minutes after the previous build (5b7487d9528a49f6b83d41c772529b4d02d08a363c4501a60a3c8f9a3eeb53fa). Earlier builds in the series were unpacked statically and each held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. This build compared against the previous one: 44 __text functions against 42, TLSH of __text 54. The encrypted payload table holds 61 items totalling 220,542 bytes of plaintext against 77 items and 194,352 bytes in the previous build, a 13.5 percent growth. Fetched at the same probe as the concurrent build on the other Foxveil payload URL of this operator, and the two share several per-function CFG hashes that neither predecessor carries, so the loader code was updated across both series in the same hour. The encrypted payload table grew by 13.5 percent, outside the few-percent band seen between the earlier scheduled repacks of this series, so this build is under static analysis rather than filed as a repack. Results will be added as a comment once the payload is opened. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a Cloudflare 520. Not executed.