MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AMOS

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments

SHA256 hash:	cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f
SHA3-384 hash:	58ef57fbe943010b1439868feb1a3eb2fe37ddc29d66df4adae7cb980bfbad2d271ec78a93c1d2680f0b9aba8226365b
SHA1 hash:	36c020c073eafeaf041ed11649576457911c5b7c
MD5 hash:	104d50ebd1b3a42d1b2d41967e2414c2
humanhash:	oxygen-magazine-oxygen-september
File name:	macho_cc16c460ded5.bin
Download:	download sample
Signature	AMOS Create hunting rule
File size:	1'282'064 bytes
First seen:	2026-10-05 00:34:24 UTC
Last seen:	2026-10-05 00:35:30 UTC
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	24576:1D15eJqwal17aKyG0hYPZsX4rtWZkB1Nno3Gz/3LameGE1YP5QHO9TmFGB5:1CqwXKyGKYBlz1Nn+VmeG+Yhtv5
TLSH	T1DF55F200CF67549BF48CE7352E2B0A339E216194CA8561DE52622F88DE363E3F65F25D
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	c4ffeine
Tags:	AMOS ClickFix Foxveil Loader Mach-O machO macOS

c4ffeine

Foxveil 'quill' build Mach-O, the ONE HUNDRED AND SIXTY-FIFTH payload served from this one unchanged URL (fat x86_64+arm64, 1,282,064 B), fetched via Tor 2026-10-05 00:21:10 UTC, origin build time 00:09:39, 2 hours 59 minutes after the previous build 9540edc81deca25acdd3b88b1eafa2d44805abf165875fa0f15b3df374032773 (built 21:09:45). Same loader family as the previous build by function-level CFG match (TLSH of __text 68, inside the 11 to 128 band measured between builds of this family) and a payload table of 247,778 B plaintext against 240,066 B, but the wrapper moved with this build: Payload grew +3.21% from added obfuscation volume (+90 normalised statements) and 7 high-entropy filler decoys, with the stealer unchanged: 54 handlers both sides, 0.853 statement similarity, full AMOS capability set and identical /contact exfil shape, config delivered by ctor env-injection as a known quill loader variant. No stealer change found: no new host, path, LaunchAgent or capability keyword, handler count 54 and the /contact exfil shape both match baseline. Not executed. VirusTotal: https://www.virustotal.com/gui/file/cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f Hybrid Analysis: https://hybrid-analysis.com/sample/cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f

Intelligence

File Origin

# of uploads :

# of downloads :

130

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Other.Malware-gen.22858817.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6ac2f0cb1431d3d232de10f2/reports/ba66036d-e05b-4aad-ac13-4e9117301cc5/overview

Verdict:

Malicious

Labled as:

Mac/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f

Verdict:

Malicious

File Type:

macho fat

First seen:

2026-10-04T22:28:00Z UTC

Last seen:

2026-10-06T19:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f/

Threat name:

MacOS.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-05 00:35:31 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

12 of 36 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zqlmiyg62unmkmyttel5c3xqt3vist6uawdbrsl5keo6o4rmiyhq._file

Malware family:

AtomicStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cc16c460ded5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Amos

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cc16c460ded51ac533139917d16ef09eea894fd4058618c97d511de7722c460f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Foxveil_Loader_TaskInfo_Variant Create hunting rule
Description:	Foxveil macOS loader (ClickFix -> AMOS), quill generation with run-time settings back inside the payload script (no constructor settings file): fat x86_64+arm64 linking CoreFoundation+libSystem+libc++ but importing nothing from CoreFoundation or objc, with the task_info/mach_task_self_ resolver core in both slices inside a per-build random libc decoy import set