ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash bedc5ef2bc2ad17fd0d627b2539a47e6ad55f9b83cfe3febaf8de2ee32e9c9af.

Database Entry

IOC ID:	1932231
IOC:	bedc5ef2bc2ad17fd0d627b2539a47e6ad55f9b83cfe3febaf8de2ee32e9c9af
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-09-24 11:50:27 UTC
Last seen:	never
UUID:	4ff2ebeb-b803-11f1-abee-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos cc2 ClickFix Foxveil macOS
Reference:	https://www.virustotal.com/gui/file/bedc5ef2bc2ad17fd0d627b2539a47e6ad55f9b83cfe3febaf8de2ee32e9c9af

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 1,036,144 B), the FIFTY-NINTH payload served from https://blueprint-71.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/cc2/update, fetched via Tor 2026-09-24 10:25:58 UTC, origin build time 10:04:39, 2 hours 2 minutes after the previous build (5b7487d9528a49f6b83d41c772529b4d02d08a363c4501a60a3c8f9a3eeb53fa). Same loader family as the previous build (44 __text functions against 42, TLSH of __text 54, inside the 11 to 128 band measured between builds of this family). Fetched at the same probe as the concurrent build on the other Foxveil payload URL of this operator, and the two share several per-function CFG hashes that neither predecessor carries, so the loader code was updated across both series in the same hour. Payload table 220,542 B plaintext against 194,352 B, a 13.5 percent growth: under static analysis, not filed as a repack. Not executed. VirusTotal: https://www.virustotal.com/gui/file/bedc5ef2bc2ad17fd0d627b2539a47e6ad55f9b83cfe3febaf8de2ee32e9c9af Hybrid Analysis: https://hybrid-analysis.com/sample/bedc5ef2bc2ad17fd0d627b2539a47e6ad55f9b83cfe3febaf8de2ee32e9c9af