ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 57fc974927b70736976b88fd369e7547892d8f227e7aa1a322e5b61aa562a93a.

Database Entry

IOC ID:	1932232
IOC:	57fc974927b70736976b88fd369e7547892d8f227e7aa1a322e5b61aa562a93a
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-09-24 11:50:26 UTC
Last seen:	never
UUID:	6f9296cc-b803-11f1-abee-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos ClickFix DANTE Foxveil macOS
Reference:	https://www.virustotal.com/gui/file/57fc974927b70736976b88fd369e7547892d8f227e7aa1a322e5b61aa562a93a

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 969,648 B), the TWELFTH payload served from https://journeylake11.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/DANTE/update, fetched via Tor 2026-09-24 10:26:04 UTC, origin build time 10:07:11, 3 hours 1 minute after the previous build (5d73b00bd37e96853bcb1f2cba845ce806b3c0dd8b83be3aaa58d0f42a235152). Same loader family as the previous build (45 __text functions against 43, TLSH of __text 65, inside the 11 to 128 band measured between builds of this family). Fetched at the same probe as the concurrent build on the other Foxveil payload URL of this operator, and the two share several per-function CFG hashes that neither predecessor carries, so the loader code was updated across both series in the same hour. Payload table 192,241 B plaintext against 192,008 B; item table layout changed, cold open pending: under static analysis, not filed as a repack. Not executed. VirusTotal: https://www.virustotal.com/gui/file/57fc974927b70736976b88fd369e7547892d8f227e7aa1a322e5b61aa562a93a Hybrid Analysis: https://hybrid-analysis.com/sample/57fc974927b70736976b88fd369e7547892d8f227e7aa1a322e5b61aa562a93a