ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 7c9e8862ec166c1809583d31b69bcf2eefd24d824120470e68840154cb39a35b.

Database Entry

IOC ID:	1973413
IOC:	7c9e8862ec166c1809583d31b69bcf2eefd24d824120470e68840154cb39a35b
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-10-18 16:48:14 UTC
Last seen:	never
UUID:	b6456078-cb13-11f1-bd13-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos ClickFix Foxveil frame macOS
Reference:	https://www.virustotal.com/gui/file/7c9e8862ec166c1809583d31b69bcf2eefd24d824120470e68840154cb39a35b

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 1,922,608 B), the FIFTEENTH payload served from https://frame-kite.com/f/rjcf4ggdrb1wp5syzplnda/5r7r2qc0, fetched via Tor 2026-10-18 14:09:10 UTC, origin build time 14:02:08, 2 hours after the previous build (4df43116580b163364e74f71f7f1af5c748db1b43673b6080864dd0c50f9a668, built 12:02:08). Same loader family as the previous build by function-level CFG match (TLSH of __text 71, inside the 11 to 128 band measured between builds of this family) and a payload table of 268,242 B plaintext against 260,102 B, but the wrapper moved with this build: Obfuscator rebuild with 24 filler items (was 6), new PBKDF2 count 96422 and compiled-script encoding growth of 1.3 percent against frame 14. Same stealer as frame 14: 57 handlers, 134 shell calls, identical path set and literal content, config still env-injected with no hosts in the sample. Not executed. VirusTotal: https://www.virustotal.com/gui/file/7c9e8862ec166c1809583d31b69bcf2eefd24d824120470e68840154cb39a35b Hybrid Analysis: https://hybrid-analysis.com/sample/7c9e8862ec166c1809583d31b69bcf2eefd24d824120470e68840154cb39a35b