ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 66560b1d6fbeaeda88cd9b8cb60c6a5f5a0566671cab18ce4e9ea76ea01c6919.

Database Entry

IOC ID:	1971437
IOC:	66560b1d6fbeaeda88cd9b8cb60c6a5f5a0566671cab18ce4e9ea76ea01c6919
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-10-17 13:36:17 UTC
Last seen:	never
UUID:	bae2a5e4-ca2f-11f1-bd13-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos ClickFix Foxveil macOS nova
Reference:	https://www.virustotal.com/gui/file/66560b1d6fbeaeda88cd9b8cb60c6a5f5a0566671cab18ce4e9ea76ea01c6919

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 1,988,096 B), the SEVENTEENTH payload served from https://nova-75.com/f/vrhqljbnscwhbyhltuwmsq/t2990cmj, fetched via Tor 2026-10-17 13:23:56 UTC, origin build time 13:02:04, 4 hours after the previous build (8f4e0b918ba5b5b8769e08f04e4aa366acc0159b3a1179b321d776f49006c940). Same loader family as the previous build (44 __text functions against 42, TLSH of __text 182, inside the 11 to 128 band measured between builds of this family) and a payload table of 264,060 B plaintext against 265,586 B: a scheduled repack of the same AMOS stealer. Not executed. VirusTotal: https://www.virustotal.com/gui/file/66560b1d6fbeaeda88cd9b8cb60c6a5f5a0566671cab18ce4e9ea76ea01c6919 Hybrid Analysis: https://hybrid-analysis.com/sample/66560b1d6fbeaeda88cd9b8cb60c6a5f5a0566671cab18ce4e9ea76ea01c6919