MalwareBazaar Database

c4ffeine

Foxveil 'willow' build Mach-O, the FOUR HUNDRED AND NINETY-NINTH payload served from this one unchanged URL (fat x86_64+arm64, 5,103,728 B), fetched via Tor 2026-11-06 20:07:58 UTC, origin build time 20:05:34, 1 hour after the previous build. The origin is nginx, so each build time is readable from the ETag: the payloads served behind this URL were stamped 2026-10-13 16:05:21, 2026-10-14 15:05:27, 2026-10-15 01:05:21, 2026-10-17 00:05:26, 2026-10-18 00:05:25, 19:05:36, 20:05:27, 22:05:25, 23:05:31, 2026-10-19 00:05:24, 01:05:35, 05:05:33, 07:05:34, 08:05:26, 09:05:35, 10:05:27, 11:15:08, 12:05:27, 13:05:34, 15:05:34, 16:05:26, 17:05:33, 18:05:28, 19:05:34, 22:05:28, 23:05:33, 2026-10-20 00:05:28, 01:05:31, 02:05:28, 04:05:26, 05:05:31, 06:05:26, 07:05:34, 09:05:35, 11:05:32, 12:05:26, 13:05:33, 14:05:28, 15:05:32, 16:05:24, 17:05:33, 18:05:28, 19:05:31, 20:05:28, 21:05:32, 22:05:26, 23:05:32, 2026-10-21 00:05:27, 01:05:31, 02:05:28, 03:05:34, 04:05:27, 05:05:33, 06:05:26, 07:05:34, 08:05:27, 09:05:31, 10:05:29, 11:05:31, 12:05:27, 13:05:32, 14:05:26, 15:05:32, 16:05:27, 17:05:33, 18:05:28, 19:05:34, 20:05:27, 21:25:05, 22:05:27, 23:05:32, 2026-10-22 00:05:26, 2026-10-23 00:05:27, 15:05:33, 16:05:27, 17:05:31, 18:05:29, 19:05:33, 20:05:24, 21:05:31, 22:05:26, 23:05:32, 2026-10-24 00:05:27, 2026-10-25 08:05:25, 09:05:33, 10:05:26, 11:05:34, 12:05:26, 13:05:33, 13:58:08, 14:05:33, 15:05:26, 16:05:33, 17:05:28, 18:05:31, 19:05:27, 20:05:32, 21:05:27, 22:05:31, 23:05:25, 2026-10-26 00:05:30, 2026-10-27 00:05:31, 2026-10-28 00:05:31, 2026-10-29 00:05:32, 2026-10-30 00:05:31, 06:05:32, 07:05:27, 08:05:56, 09:05:26, 10:05:31, 11:05:25, 12:05:32, 13:05:25, 15:05:27, 16:05:35, 17:05:27, 18:05:31, 19:05:28, 20:05:30, 21:05:29, 22:05:33, 22:51:05, 23:05:27, 2026-10-31 00:05:32, 2026-11-01 00:05:32, 01:05:25, 02:05:34, 03:05:25, 04:05:31, 05:05:27, 06:05:33, 07:05:25, 2026-11-02 00:05:32, 2026-11-03 00:05:31, 2026-11-04 00:05:40, 2026-11-05 00:05:32, 2026-11-06 00:05:33 and 20:05:34 UTC. The job skips hours rather than running on a fixed interval, and the gaps measured so far run from 2 minutes to 23 hours. Hash sequence on the same URL: 486277d29cbefcbd321d7c7ad5d72bf1983c110206ed607c6c371af7f7741308 (1,150,272 B, 2026-10-13 16:05:21), 09eb8bbdddc17ce5be1c176dcdac2b812414fa3691ceb5fa81e7ef6e20a20f6e (1,281,696 B, 2026-10-14 23:05:21), 6e4e0b1a8238f55f313bf64bbc162a51d971e93811136a6fa402b7128278ea63 (1,890,336 B, 2026-10-16 13:05:33), 00688ae85b8041d81832b0f7f0552b7bb2c84b46ac72c1e6bcc5ff71ecefe2ec (1,889,504 B, 2026-10-17 20:05:25), 5fe8ee5236cbf00491b1e8a8d41ca59dcc5dd0fbc5ad5dd1fc4b60e98abdd7ed (2,004,096 B, 2026-10-18 18:05:27), c0e60b8b072782b0cad0b70604aeb587c0ca5366d15af5e0a2b62c81fd626460 (2,168,848 B, 2026-10-18 19:05:36), 218ee68ec44c3deef77ff315a1f8bbb948aa108b4b5e2baa7a9b05770927f23e (1,972,048 B, 2026-10-18 20:05:27), d5af897e697a845f310b585740bb2ebf26fd218c529a205f87268bb1652fc256 (1,594,032 B, 2026-10-18 22:05:25), e0f6754b62b957cda8188934366f173aa9bb8ed2beda8f3d668f9c881835a5e8 (1,708,848 B, 2026-10-18 23:05:31), 4d9b98e6f17e737cbaaf056d6b720708f9b293bb77361e50b751d20382dd8176 (1,594,064 B, 2026-10-19 00:05:24), d36d5a65f34f39ca8092530979730dd125672653011e5e34f8d943add3729e0a (1,857,264 B, 2026-10-19 03:05:33), 4610c7088ec870dddbd0116776b5f753990626add6a60ce5602114ce1aac2077 (1,905,888 B, 2026-10-19 05:05:33), a068896ea2b9af7d17576ddecef8f6be7126c3262f18b1a30da29f2d6af41110 (1,987,856 B, 2026-10-19 07:05:34), c77e8254819e19bf277948537724fdd2fa90f45fbc81d342c688432228282b89 (1,758,976 B, 2026-10-19 08:05:26), 021288e9fdeba5059b52bc11074260734c909e9f780cca1bb0ad14d8406c2039 (2,085,760 B, 2026-10-19 09:05:35), 55ac7a2beaec0c42cea15bc5c3265235e8ea97b3c921f7382177dfc79613555a (1,856,416 B, 2026-10-19 10:05:27), c32ba6a498f52f4aa831dcc0ef66da00380a5519d60c8b7eede24e8f04bdeea3 (2,152,000 B, 2026-10-19 11:15:08), 21550fd4b66485e039d25b33d52b2bcd7842f0a7a8ae8ecbd6c96f1fba1496c9 (1,988,528 B, 2026-10-19 12:05:27), 39c8844fdc6d60a34652d4fd10020a7e4eb709d756b6eb5d9742c0c187e8a14d (2,036,528 B, 2026-10-19 13:05:34), 2712cf9d7213439af0cbf786945b4897cb4e5be2b002530e14cb5c34f160f990 (2,070,768 B, 2026-10-19 15:05:34), 25f67a594ccdc83fa49c751a865bb56259f868fa78936696c0a9bb353470479f (1,906,640 B, 2026-10-19 16:05:26), 622bf6c8c4a95aa3dda63b5afc070f76660c3b8c725bacb73c99ec6e036671b7 (2,102,720 B, 2026-10-19 17:05:33), fe8128f91f8207ffd86b44b8fbc4ae67696a3f47a1dacbf6e8dc2cc79e77eee3 (1,955,600 B, 2026-10-19 18:05:28), 0e20f67fdad9148a186f0fa99cefb448bccdce7220484f173e05add736fa3815 (2,053,104 B, 2026-10-19 19:05:34), 7becf99286d1775255d5ba2b366d0576849cfb5250b3a61b7164991a03d75369 (2,020,400 B, 2026-10-19 22:05:28), e3efe3a90dbddf23bda1dfacb089fa2df42b0e4851559609c502d951f45f6b24 (1,939,280 B, 2026-10-19 23:05:33), 2d6f829d87773207cabc9360f8aae81adcf838829be00b0b6040fb7ebccf393e (1,890,016 B, 2026-10-20 00:05:28), 4ba5aa5bf31d9066dff8a63a7dfaa241482bd5599ea312f979b68e2f50ec3d96 (1,692,352 B, 2026-10-20 01:05:31), 2e1c133f28b1d0ff70cfdf24f59263412f2323ab16bc35c8d910d441e848c0e4 (2,135,824 B, 2026-10-20 02:05:28), 75e4994373a51dbfe5f22f0f071c05dbedd077d80aa6a0051374121780868707 (1,954,992 B, 2026-10-20 04:05:26), e01bd2a000cc1e1212ce7420b308a7a345dfef5efca112fa50cadf7a60594f3d (1,808,544 B, 2026-10-20 05:05:31), a6dd4b382ef71892d14035410079ff489dcfb6258837baa9debf827846135293 (1,857,312 B, 2026-10-20 06:05:26), 39d2c2399687e22329000ce55697a11c2e86efb7cc5828345e6b80e80b9c84c2 (1,955,456 B, 2026-10-20 07:05:34), 22d30324d0bcc312317a034383645dc44286439d7aed5a4a24a6cfc4a45b944f (2,233,472 B, 2026-10-20 09:05:35), 9e2cdcfb651459a46ab5d74b3766fbd671374b05c7a5fcd48e297ee926f5c6d7 (1,873,248 B, 2026-10-20 11:05:32), 97046b741b6ad86fe262c5ce86bdc283edead27a52ef6d43ebbae7cb1f4eb891 (1,906,000 B, 2026-10-20 12:05:26), d4310ec0bfdd4d74035591bd5d065e5220cdd790af2068fadae4bb525bc5dd0f (1,955,184 B, 2026-10-20 13:05:33), f6a574ccf574a779e8a6767950928532599d98bfb275a79e4bf3fd856d74580b (2,151,728 B, 2026-10-20 14:05:28), d5e7f9e31c895499576d72ec5a4dd7d2b6e205f163729807adc306b47d35f785 (1,938,160 B, 2026-10-20 15:05:32), 8c9e3f6569498056139621c2305beaf8b257d6e60f9e35bd9420554a10a1a47f (1,939,040 B, 2026-10-20 16:05:24), bf2e58e24d2708e25d437e91744ad358bed1e34dd5a57dd33d15b04ab68e6669 (2,069,168 B, 2026-10-20 17:05:33), 6ab3dfc10b2d01037315fd23532a57fc5ed52df1c64c2b48126c0a1cafa02087 (2,135,120 B, 2026-10-20 18:05:28), 28e9b638250dfabc2a7fb71ce76c00d5c015b63f470620555c375ed75bf93cc7 (1,856,320 B, 2026-10-20 19:05:31), 270b70291a291866225357beb0f7d202fb083d2682d5013a81efd38fd99c565f (2,119,248 B, 2026-10-20 20:05:28), 1c45e83f214fc193d3c643fdd08bac440e1c25cec08f5e9abb0b113390a8afb2 (1,676,560 B, 2026-10-20 21:05:32), 0489db9272d275f0bcc9532930ad5822c95d9a63a35c42d0fcee1741305478c8 (1,627,216 B, 2026-10-20 22:05:26), c43d861bfd21115f12743d61f2c59fd5209300ab3c4b00b2ac013b887669ec21 (1,824,240 B, 2026-10-20 23:05:32), 7e189c577e071818400830e2ae8ad41be5894064e33199e9c3d744c712f38542 (2,135,664 B, 2026-10-21 00:05:27), 8f119c943521738521a5e05d4c0fa5a85f756cc2b00fb276c251d32f6d7af09e (1,939,504 B, 2026-10-21 01:05:31), c491fb2328aef79f34e7614ced56bed62966e8063b50eb8ea7c926a188789587 (2,036,512 B, 2026-10-21 02:05:28), fa5a12657457684283559ee563d93bc689ce36fe013cc4da9912a6a525a3f5c6 (1,905,056 B, 2026-10-21 03:05:34), c66da66fee552460de019b65b0824e4015bca4344d3df307592754a359a430e0 (2,135,504 B, 2026-10-21 04:05:27), 382f4d278e49493358943838a815e781890e0966a7bf69cad975dfce3219b272 (1,890,208 B, 2026-10-21 05:05:33), b79064543b02fdfcab83cefaa96ecbdedbe43b2b917bf7b53d32c5d7dea06ed4 (1,939,392 B, 2026-10-21 06:05:26), c3fee028fb9ac3f7fc6871c1d316ad2c28ed57cd655db9ade13fe529ce5c0823 (2,200,896 B, 2026-10-21 07:05:34), 66c8c5608b33584b77762dfce9954f7282cc5d67836f6f03a78b8d0f5b22aa45 (1,939,008 B, 2026-10-21 08:05:27), 0451f7a59ed7f1554cdce8e8ecde55fd14e1c4bfa7635ba59216c909b6f2170b (1,791,520 B, 2026-10-21 09:05:31), e891765fa4f35de3c3b529d3ca8119e0a2bfcc837219bc54a5b1fb08331560a5 (2,168,752 B, 2026-10-21 10:05:29), 5e74c21baf3f640e4a6334ac58dd9e0f3d3a29041098eda1204f70a6eae8223b (1,889,536 B, 2026-10-21 11:05:31), 3aeae0c7102ced8c24183c77e4252da66e1c4118c10527bfdb1e14bb291f0c7f (1,955,856 B, 2026-10-21 12:05:27), fa8b547639ddc7edcf86f146102b69e3782b94cf8e65a0d69e0f519c92b918e3 (1,938,752 B, 2026-10-21 13:05:32), 2396cecdf7a12ed0ad452e865e8f17ce5c6b90296f54fbfc9c05d41cc6fff1c5 (1,939,264 B, 2026-10-21 14:05:26), 5472a9074352ff8636463751107889ed5f32e805586ecc711a4ae80c81f9e339 (1,873,296 B, 2026-10-21 15:05:32), 22955290834a5867c784fc35d9774403862c194f7ce08f4a34e7974d70be1401 (1,987,728 B, 2026-10-21 16:05:27), c2911023d7e479fea784568beb7e7df44871a3605bf9ecf02bffdf713c46fa9a (1,856,912 B, 2026-10-21 17:05:33), 7daecea2744a91345b1f6f6a6216e08588b0845c2646622ec5c859dae054ca37 (2,020,560 B, 2026-10-21 18:05:28), d005fa0e57d4143c39b5c9d2068cea8056fc3b3128d9d4132861e003468564b1 (1,922,048 B, 2026-10-21 19:05:34), 81a8a5436cc688dfd35008909c127276e0da0b64ff7543c8ec30ce3a4c580331 (1,741,808 B, 2026-10-21 20:05:27), 6b9deaad7a9e0261b8a5352933a7a72ed44a4607359918c77c3e7d0dec1899ed (2,282,224 B, 2026-10-21 21:25:05), 6a6bc1031590dddd55d9b087ba8fa60075471e36bf3b002e351c153ad20a5446 (1,873,152 B, 2026-10-21 22:05:27), 7a432eb04d64e19851339b75174abba4cf0d06c6975baccfc37eff2b16b338ca (1,987,744 B, 2026-10-21 23:05:32), bf13273062b560eab32373d3634d53d01e3789383c1f0a0967233d4d8c2fbd9d (2,103,152 B, 2026-10-22 23:05:34), f558b3deb1952b33e0e616b0d8f3e258ac23d527a248dd5ddac217202ab77007 (2,102,720 B, 2026-10-23 14:05:29), 1956a73927254c77fea331a9221a62e23175439ca9065ed257054a5d8ce7321c (2,250,096 B, 2026-10-23 15:05:33), 13841620a19483067986fa872137e576506e00146dd87b2d3eb14a2b16f9504a (1,873,184 B, 2026-10-23 16:05:27), acd6df8ee31ed636de43d1ca0d37dcd9581cabfad6059de6d2a70076ef585550 (1,774,384 B, 2026-10-23 17:05:31), 6497ae0df78fe72409b86f7dea6999eb98d08b28fadb8a8990e73c7d9e89c7f8 (2,216,672 B, 2026-10-23 18:05:29), 009bb48ae33043edf54cd84c6ae8e074c3e303e1f9139b3e4842833e415ba922 (2,086,672 B, 2026-10-23 19:05:33), 93c9cd39439f8f93634f6eed49784dffcecd39fd2425ff842cae5ff3a6d0ee93 (1,791,808 B, 2026-10-23 20:05:24), 239a7ae7e6c40dce3ef3219a498f245e696e3ffeeae7b166cad5529c2085dd43 (1,724,608 B, 2026-10-23 21:05:31), f0f8af17aac6d83c1b5876b180a75677e130a1dad851c7965f543c1c818b269a (1,824,080 B, 2026-10-23 22:05:26), 569e67288cb2b6ccf01429605de233905ad9d20b84302b75bd53e71de0605665 (1,955,392 B, 2026-10-23 23:05:32), 2fbb749676ddd4c2157167b6aca1e4fff7f73e6aa0f90cb3f3ac87c7f515a09d (1,939,456 B, 2026-10-25 07:05:32), de27259228870b287bc196249bf3b66f37625b5505e0ed9011dc9222a90c1c36 (1,807,408 B, 2026-10-25 08:05:25), 9d3706768c1aba1f22fdfe982cdf1267eaada0582b92f41e4c74886ebe25c9be (2,053,600 B, 2026-10-25 09:05:33), 5608d12baa8021f820e8aa54bbd9b207f59a68de117c24a1a9e3a0592caf543d (1,938,576 B, 2026-10-25 10:05:26), a7efae4d877b1e3faebe958851e4682681af1377eb23fa494b6183c79eff184d (2,151,520 B, 2026-10-25 11:05:34), 40a350d268892d102c2e114ed6e3c0603d2073b24be0ce10986e62453f84d474 (1,692,272 B, 2026-10-25 12:05:26), ac6222ea0fb8dbecba185293854fade8d29725a41acf61bff5b6b8eca090e453 (1,741,728 B, 2026-10-25 13:05:33), 8b8c990d911f65af5710d415e8bfd999fd956f320802ee5c0513ea4827510b01 (1,724,432 B, 2026-10-25 13:58:08), 8f204cac36107e51577f12abe2b8729d0128f475367cc07ba6853ec798bb4f7f (2,053,360 B, 2026-10-25 14:05:33), 4c2e53a2f9b3606fe82f27fe2948f5b81a1f4d5b1e571085fbbcdc6f5664f034 (1,938,832 B, 2026-10-25 15:05:26), e95b05aaa891610220a527f6923771d049b301d48d15b20abebf6a1e66928a18 (1,824,432 B, 2026-10-25 16:05:33), b3139c27bcae3c2c2839ddd1a6a9103905530b6ce2f4706709a1eac105046a73 (2,169,056 B, 2026-10-25 17:05:28), fdffbe75bcb61056b58b07c8d317c856045cfd46cfbfa6d4c6216abe3f96ad43 (1,971,440 B, 2026-10-25 18:05:31), b66b538b86a108868153741c7ac54c2c204ee7814046202e76870c9bf8d3e31d (2,086,544 B, 2026-10-25 19:05:27), d2f0bfec23ee84a10896c3ed0ca41dc9620238e6aa766c484e7e161f51c518a7 (1,741,952 B, 2026-10-25 20:05:32), 55d218a123621a4939a01a22866ad4464afa7f006f8e74c2b70f59c5947f31ba (2,152,576 B, 2026-10-25 21:05:27), c25ca6176f2884c3b551b38f30c344f77a8addd6153bc7b4534c9a1fe80787a7 (1,906,256 B, 2026-10-25 22:05:31), 31b629d19b105c776b2df87923817b612d40e24eb25feed0c9290e86a903ca04 (1,824,512 B, 2026-10-25 23:05:25), 1110ecc48012b50c32ff189ddc8acbe4b9cd118d5ee2991f79cb43ef2968778b (1,709,440 B, 2026-10-26 23:05:25), 0379a855b0902aaa73de9433070a13a2f6043a3f0e53f7ced37f1127340db30d (1,873,632 B, 2026-10-27 23:05:25), 401b72f3b6b63fb07102d79cce36fcd4860ab23753ae422e598edce1139828b9 (2,136,064 B, 2026-10-28 23:05:28), 3c0deee92fdc43f513533ea9703e14313e9a1b298563864133663eb18a12141f (1,906,416 B, 2026-10-29 23:05:26), 10ffda89d06d75ea0f94d548645e0dd51ca30a0ff2f9134acb8e47f0f48f0c81 (1,954,928 B, 2026-10-30 05:05:28), 1c00f07412c5098955a94d2c34819f79b086e0e7091d19c71a99278de83756e5 (2,037,536 B, 2026-10-30 06:05:32), 85b6b1a7af68ad5789fd472ca95ed8e5ddf8ed567baf6df46753a92bf63720d0 (2,086,464 B, 2026-10-30 07:05:27), 26c08d8b1311c5921d31499c3122547a688fe0a0b98026e2e7a54552b222243e (1,578,656 B, 2026-10-30 08:05:56), 7bb9d644c44570fc1e08e5bac5e0444b1d2e00017e7754026da6d6ed87279f0f (1,774,592 B, 2026-10-30 09:05:26), c0503b0d624b030d60106d7cc01e51ea8dff031c434573d01098e4492bbe7282 (1,889,856 B, 2026-10-30 10:05:31), 547ad12344d2fae439421683ec7caf70432429d8736ba34b89599006a92170be (1,693,248 B, 2026-10-30 11:05:25), 17888a80a9f18bce05043565ed27096dc0fc3213079947b080fb8c5752833bbf (1,872,016 B, 2026-10-30 12:05:32), b4baf343272da67fd6593482208c499d5fe7fbc2ae6dc59e5dfd08c54fd26923 (1,905,536 B, 2026-10-30 13:05:25), 52ef7f4f8d5211dc55a7e008c66f906f3ba810da661fb5351532e8f90236467d (2,217,936 B, 2026-10-30 15:05:27), 681ff35fabe10fe1200856a549f6a71c1dd7adae67bd7078565f1d1f2b16e3a5 (1,971,904 B, 2026-10-30 16:05:35), d70d421cd4c92e3914f2e0c26db158985cf154c2f99d2bf185c72310c711651e (2,168,160 B, 2026-10-30 17:05:27), c3a510c92b6b87bb8a3ff74393a7adffeee892749bf7f4c46cb4a8d5e278811f (1,938,112 B, 2026-10-30 18:05:31), 4bb7bb216a23776f9bd0bfa0d346e70b303eb2f683490c85f35d2733778f12d7 (2,119,072 B, 2026-10-30 19:05:28), 6bb4fcb80271a46798fe3847952767969efcf60dc7ace7b059c7cb962cce2ecd (1,659,856 B, 2026-10-30 20:05:30), abafffb7d8e4a217950bae3cd8e171ef8de8622fd1432af91c29a5eafdd4334b (2,085,984 B, 2026-10-30 21:05:29), b9f3a08ab04e81e13f4d3571fc9700c56cb1bb45106cc28bbb6109408120e986 (2,119,488 B, 2026-10-30 22:05:33), a80db01f9d80275cf85543c9ed0dbd70963b8e373a6806a99edbdb2b429a2b24 (2,020,816 B, 2026-10-30 22:51:05), f29b6e9963e687828c2c73c9b2cf41195e35b12ab4801d9187fe8536b622fcd0 (2,037,008 B, 2026-10-30 23:05:27), 6a7befb131816e28518049a05ac4b7055b6f5b389a819115d0a36ac3a6f093a5 (2,036,752 B, 2026-10-31 01:05:26), e9e8cbb6e60dec133269e83d5c9564b5fca8ff5293233ae2766bdfc1e17503d0 (1,808,032 B, 2026-11-01 00:05:32), 25ef393b240a17e8bca188665dd9be56f4340ec2c3184b9d9b59415a93909156 (1,922,928 B, 2026-11-01 01:05:25), 166fa627a1d63c4b6d198e8a383400048b5ce5260eda938948689bd43c647c10 (1,987,824 B, 2026-11-01 02:05:34), 0216f55f71a473be20533dcfd5aec30a67d6034230ad163888e577cae562093f (1,840,480 B, 2026-11-01 03:05:25), 75d651ab64e00d99d33cce4ec6b6fe77a84af73a174e9904bdb284b0f1a2d054 (1,775,264 B, 2026-11-01 04:05:31), f8e848436352228b02f6db2e4778edb2771a4a894ab9ddf169c7bd4e4fdfea81 (2,053,520 B, 2026-11-01 05:05:27), 915e89196485284e2b535cdaabde0b058fd171c603ff27f7f071a6e563796801 (2,135,792 B, 2026-11-01 06:05:33), 76c2ebeaf6e3d3e1d287fd5f54e4972c907752856d86a45f2b1fa5c79e5ccddc (2,118,624 B, 2026-11-01 23:05:28), 74586c072b6cf57fcf1ea74b2ef13a17af814837a034b71f67681478c83d306c (2,332,960 B, 2026-11-02 23:05:29), d4242682bc56d0c41732b189adfe7ba3eaf47bc19a8a427456258dcfcb91c8b1 (1,938,928 B, 2026-11-03 23:05:27), 39a21b750b557b760ca65e54b7ee44e601bd4278b8486a1ebc31498fd26b8c49 (1,824,368 B, 2026-11-04 23:05:25), 03cdf42be8d913d45bc9af485fca7e1377876f465fbcee5544299491d36da1d3 (5,694,288 B, 2026-11-05 23:05:32), 01e6f03b3dfc4467e9896ca20cdd47fa396efece2dcc95b90535c3a0f6178938 (5,448,832 B, 2026-11-06 19:05:30), then this one. The stage-1 dropper on this host is not on our watch list, so only the payload URL is measured. The first build in the series was unpacked statically and held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. This build compared against the previous one: 44 __text functions against 45, TLSH of __text 45, within the range measured between builds of this family. The encrypted payload table holds 74 items totalling 262,160 bytes of plaintext against 90 items and 264,778 bytes in the previous build, a 1.0 percent move: the same script re-chunked. This build was not unpacked. Host serves the payload to browser and curl User-Agents alike. Not executed.