ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 2e1c133f28b1d0ff70cfdf24f59263412f2323ab16bc35c8d910d441e848c0e4.

Database Entry

IOC ID:	1974889
IOC:	2e1c133f28b1d0ff70cfdf24f59263412f2323ab16bc35c8d910d441e848c0e4
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-10-20 02:20:57 UTC
Last seen:	never
UUID:	e2420527-cc2c-11f1-bd13-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos ClickFix Foxveil macOS willow
Reference:	https://www.virustotal.com/gui/file/2e1c133f28b1d0ff70cfdf24f59263412f2323ab16bc35c8d910d441e848c0e4

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 2,135,824 B), the ONE HUNDREDTH payload served from https://willow-13.com/f/4nsri1yksbqlneewnevynq/cvfo3thd, fetched via Tor 2026-10-20 02:11:23 UTC, origin build time 02:05:28, 59 minutes after the previous build (4ba5aa5bf31d9066dff8a63a7dfaa241482bd5599ea312f979b68e2f50ec3d96). Same loader family as the previous build (43 __text functions against 45, TLSH of __text 232, above the 11 to 128 band measured between earlier builds of this family, while the per-function CFG match still reads repack-like) and a payload table of 265,004 B plaintext against 262,642 B: a scheduled repack of the same AMOS stealer. Not executed. VirusTotal: https://www.virustotal.com/gui/file/2e1c133f28b1d0ff70cfdf24f59263412f2323ab16bc35c8d910d441e848c0e4 Hybrid Analysis: https://hybrid-analysis.com/sample/2e1c133f28b1d0ff70cfdf24f59263412f2323ab16bc35c8d910d441e848c0e4