ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 7e449df26b3b6751724b79c56211dbf6364bed247b4c3729eabe17890d2f5301.

Database Entry

IOC ID:	1971409
IOC:	7e449df26b3b6751724b79c56211dbf6364bed247b4c3729eabe17890d2f5301
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-10-17 12:47:49 UTC
Last seen:	never
UUID:	f5b2e234-ca28-11f1-bd13-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos ClickFix Foxveil macOS nova
Reference:	https://www.virustotal.com/gui/file/7e449df26b3b6751724b79c56211dbf6364bed247b4c3729eabe17890d2f5301

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 2,152,160 B), the SIXTEENTH payload served from https://nova-75.com/f/vrhqljbnscwhbyhltuwmsq/t2990cmj, fetched via Tor 2026-10-17 12:26:46 UTC, origin build time 12:01:58, 2 hours 59 minutes after the previous build (8f4e0b918ba5b5b8769e08f04e4aa366acc0159b3a1179b321d776f49006c940). Same loader family as the previous build (44 __text functions against 42, TLSH of __text 175, inside the 11 to 128 band measured between builds of this family) and a payload table of 259,360 B plaintext against 265,586 B: a scheduled repack of the same AMOS stealer. Not executed. VirusTotal: https://www.virustotal.com/gui/file/7e449df26b3b6751724b79c56211dbf6364bed247b4c3729eabe17890d2f5301 Hybrid Analysis: https://hybrid-analysis.com/sample/7e449df26b3b6751724b79c56211dbf6364bed247b4c3729eabe17890d2f5301