MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eae1ad551a79a4c8333b098258aab12566f538efcc0c8a3166bcf2f26a0ae2c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AMOS

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	eae1ad551a79a4c8333b098258aab12566f538efcc0c8a3166bcf2f26a0ae2c5
SHA3-384 hash:	59a0af8910cfb4afef5692ca49ef42fc8d027a2b8f772eab3bed436b173429af4dc8294a189197971c9ab2abcd756c50
SHA1 hash:	734557b8ba528923b7d9c67c16154ccf829f24f0
MD5 hash:	ce86d2860291a0d82d54f7d547cc6250
humanhash:	yankee-uncle-enemy-nitrogen
File name:	macho_eae1ad551a79.bin
Download:	download sample
Signature	AMOS Create hunting rule
File size:	2'167'248 bytes
First seen:	2026-10-19 01:43:19 UTC
Last seen:	Never
File type:	macho
MIME type:	application/x-mach-binary
ssdeep	24576:CovTGm6aR41rBhlV1PhCPEolojEXMSrUn3N2k5SmdenIhpbAL9PVFs34bpUb5fXn:l76aSlBhDLEUWs3N7eWpL4pUpXmVxXA
TLSH	T101A5F124517B2236E0432532DC200FD994AD6AF099DCF9E76625D3222CB6AE7E573373
TrID	82.2% (.DYLIB) Mac OS X Mach-O universal Dynamically linked shared Library (32500/1/5) 17.7% (.O/DYLIB/BUNDLE) Mac OS X Universal Binary (generic) (7002/2)
Magika	macho
Reporter	c4ffeine
Tags:	AMOS ClickFix Foxveil Loader Mach-O machO macOS

c4ffeine

Foxveil 'willow' build Mach-O, the EIGHTIETH payload served from this one unchanged URL (fat x86_64+arm64, 2,167,248 B), fetched via Tor 2026-10-19 01:37:08 UTC, origin build time 01:05:35, 1 hour after the previous build. The origin is nginx, so each build time is readable from the ETag: the payloads served behind this URL were stamped 2026-10-13 16:05:21, 2026-10-14 15:05:27, 2026-10-15 01:05:21, 2026-10-17 00:05:26, 2026-10-18 00:05:25, 19:05:36, 20:05:27, 22:05:25, 23:05:31, 2026-10-19 00:05:24 and 01:05:35 UTC. The job skips hours rather than running on a fixed interval, and the gaps measured so far run from 11 minutes to 23 hours. Hash sequence on the same URL: 486277d29cbefcbd321d7c7ad5d72bf1983c110206ed607c6c371af7f7741308 (1,150,272 B, 2026-10-13 16:05:21), 09eb8bbdddc17ce5be1c176dcdac2b812414fa3691ceb5fa81e7ef6e20a20f6e (1,281,696 B, 2026-10-14 23:05:21), 6e4e0b1a8238f55f313bf64bbc162a51d971e93811136a6fa402b7128278ea63 (1,890,336 B, 2026-10-16 13:05:33), 00688ae85b8041d81832b0f7f0552b7bb2c84b46ac72c1e6bcc5ff71ecefe2ec (1,889,504 B, 2026-10-17 20:05:25), 5fe8ee5236cbf00491b1e8a8d41ca59dcc5dd0fbc5ad5dd1fc4b60e98abdd7ed (2,004,096 B, 2026-10-18 18:05:27), c0e60b8b072782b0cad0b70604aeb587c0ca5366d15af5e0a2b62c81fd626460 (2,168,848 B, 2026-10-18 19:05:36), 218ee68ec44c3deef77ff315a1f8bbb948aa108b4b5e2baa7a9b05770927f23e (1,972,048 B, 2026-10-18 20:05:27), d5af897e697a845f310b585740bb2ebf26fd218c529a205f87268bb1652fc256 (1,594,032 B, 2026-10-18 22:05:25), e0f6754b62b957cda8188934366f173aa9bb8ed2beda8f3d668f9c881835a5e8 (1,708,848 B, 2026-10-18 23:05:31), 4d9b98e6f17e737cbaaf056d6b720708f9b293bb77361e50b751d20382dd8176 (1,594,064 B, 2026-10-19 00:05:24), then this one. The stage-1 dropper on this host is not on our watch list, so only the payload URL is measured. The first build in the series was unpacked statically and held the same AMOS AppleScript stealer, with the same 47 handlers, hosts and persistence, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself. What rotates is the wrapper: obfuscation volume, PBKDF2 iteration count, encrypted item count and table layout, tokens and the ad-hoc code signing identity. This build compared against the previous one: 45 __text functions against 44, TLSH of __text 120, within the range measured between builds of this family. The encrypted payload table holds 80 items totalling 260,506 bytes of plaintext against 90 items and 266,110 bytes in the previous build, a 2.1 percent move: the same script re-chunked. This build was not unpacked. Host serves the payload to browser and curl User-Agents alike. Not executed.

Intelligence

File Origin

# of uploads :

# of downloads :

160

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.MacOS.Agent-BWZ.58517513.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad575f05a22ac805bd7cce1

Tags:

n/a

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6ad575ed46fd038c76654621/reports/2234ec32-59a7-45f1-bbda-4ff5edb12961/overview

Verdict:

Malicious

Labled as:

Mac/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/eae1ad551a79a4c8333b098258aab12566f538efcc0c8a3166bcf2f26a0ae2c5

Verdict:

Malicious

File Type:

macho fat

First seen:

2026-10-20T18:35:00Z UTC

Last seen:

2026-10-20T18:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/eae1ad551a79a4c8333b098258aab12566f538efcc0c8a3166bcf2f26a0ae2c5/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

Mach-O universal binary

Link:

https://malprob.io/report/eae1ad551a79a4c8333b098258aab12566f538efcc0c8a3166bcf2f26a0ae2c5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eae1ad551a79a4c8333b098258aab12566f538efcc0c8a3166bcf2f26a0ae2c5/

Threat name:

MacOS.Trojan.Generic

Status:

Suspicious

First seen:

2026-10-19 01:44:22 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

7 of 23 (30.43%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5lq22vi2pgsmqmz3bgbfrkvrevtpkohpzqgiumlgxtzpe2qk4lcq._file

Malware family:

AtomicStealer

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/eae1ad551a79/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/eae1ad551a79a4c8333b098258aab12566f538efcc0c8a3166bcf2f26a0ae2c5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	Foxveil_Loader_TaskInfo_Variant Create hunting rule
Description:	Foxveil macOS loader (ClickFix -> AMOS), quill generation with run-time settings back inside the payload script (no constructor settings file): fat x86_64+arm64 linking CoreFoundation+libSystem+libc++ but importing nothing from CoreFoundation or objc, with the task_info/mach_task_self_ resolver core in both slices inside a per-build random libc decoy import set