ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 4701f196c74af42b5ced01592bf4a74d54437b1c63b8aabfe1f92e9beabec769.

Database Entry

IOC ID:	1926657
IOC:	4701f196c74af42b5ced01592bf4a74d54437b1c63b8aabfe1f92e9beabec769
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-09-22 05:00:46 UTC
Last seen:	never
UUID:	180a1ed4-b5db-11f1-abee-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos cc2 ClickFix Foxveil macOS
Reference:	https://bazaar.abuse.ch/sample/4701f196c74af42b5ced01592bf4a74d54437b1c63b8aabfe1f92e9beabec769/

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 936,912 B), the EIGHTEENTH payload served from https://blueprint-71.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/cc2/update, fetched via Tor 2026-09-21 16:37:28 UTC, origin build time 16:01:36, 2 hours 59 minutes after the previous build. Build times read from the nginx ETag: 2026-09-20 07:02:41, 09:02:47, 11:03:28, 14:01:46, 15:02:41, 16:02:02, 20:05:52, 21:01:38 and 2026-09-21 00:01:43, 01:02:53, 04:03:03, 07:04:04, 11:06:32, 12:02:19, 13:02:09 and 16:01:36; the job skips hours, and measured gaps run from 55 minutes to 4 hours 3 minutes. The stage-1 zsh dropper ETag is unchanged since 2026-09-18 12:56:51; only the payload rotates. Same loader family as the previous build (42 __text functions both sides, TLSH 39), payload table 50 items / 194,264 B plaintext against 74 / 192,474, the same AMOS stealer re-chunked. Not executed.