MalwareBazaar Database

c4ffeine

Foxveil 'cc2' build Mach-O, the SEVENTH payload served from this one URL (fat x86_64+arm64, 954,528 B), fetched via Tor 2026-09-20 15:12 UTC, origin build time 15:02:41. nginx encodes the build time in the ETag, so the operator's rebuild schedule is readable without touching the host. Every payload build observed behind this URL lands in the same minute of the hour: 2026-09-20 07:02:41, 09:02:47, 11:03:28, 14:01:46 and 15:02:41 UTC. The hour spacing varies (two hours, two hours, just under three, then one), but the HH:02-03 slot does not, which points at a scheduled repack job rather than packing per request. A separate test on an earlier build supports that: six HEAD requests down six distinct Tor circuits, landing on four different Cloudflare edges, all returned the same ETag. Hash sequence on the same URL: a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9 (987,264 B, 2026-09-18), ec780ca8df9d10df905f3f77641f88ece7651303843802c37a57c484c6251a42 (937,424 B), 610ae82d0d872334ba68718030bdeb0c2d23ce592b4c9022fbb225b0208b884a (1,003,328 B), 233fd2c05865e6fc7034e61bf98e64f7afeb24c1b3e88539895eeff764ebb740 (937,152 B), 336f4bf8eb4d76c91f936beabe3a061b43db46d2cc85e6dc82dd22f9194191fc (952,800 B), 8e7d88f5adef0f2706fbc6df433e3c76d81c4b799389319e60a4639fc1c088a1 (953,280 B), then this one. The stage-1 zsh dropper at the same host has stayed byte-identical since 2026-09-18 12:56:51 (sha256 6e753133e537264247a08587d87b30b8d9a96caea1d6cc92d41fc8058073b8f7), re-checked at the time of this fetch: the delivery chain is fixed and only the payload rotates, which is why every build in this series arrives at 0 detections. Static analysis of four earlier builds in the series recovered the same AMOS AppleScript stealer each time, decrypted with a key derived from the SHA-256 of the loader's own __text section, so each repack rekeys itself with no separate key management. Host answers HTTP 200 only to a curl User-Agent; browser User-Agents get a 16-byte Cloudflare 520 on every path including the root. Analysis of this build is pending. Not executed.