ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 796fd2f47ba19b912e7923cf2cf8225869a29459b330dad294ff54a923337761.

Database Entry

IOC ID:	1971995
IOC:	796fd2f47ba19b912e7923cf2cf8225869a29459b330dad294ff54a923337761
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-10-17 20:48:15 UTC
Last seen:	never
UUID:	138c0184-ca6c-11f1-bd13-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos ClickFix Foxveil haven macOS
Reference:	https://www.virustotal.com/gui/file/796fd2f47ba19b912e7923cf2cf8225869a29459b330dad294ff54a923337761

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 2,037,808 B), the TWENTY-SIXTH payload served from https://haven-post.com/f/zh2s2xptaamrnzpdyiq0ng/vj1ury4s, fetched via Tor 2026-10-17 20:29:25 UTC, origin build time 20:02:21, 2 hours after the previous build (7063eb317ae6f0af6ffc158544d8e230e9e99e561995a1a82a6475f893b26e17). Same loader family as the previous build (44 __text functions against 45, TLSH of __text 150, inside the 11 to 128 band measured between builds of this family) and a payload table of 257,144 B plaintext against 264,544 B: a scheduled repack of the same AMOS stealer. Not executed. VirusTotal: https://www.virustotal.com/gui/file/796fd2f47ba19b912e7923cf2cf8225869a29459b330dad294ff54a923337761 Hybrid Analysis: https://hybrid-analysis.com/sample/796fd2f47ba19b912e7923cf2cf8225869a29459b330dad294ff54a923337761