ThreatFox IOC Database

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 1,808,544 B), the ONE HUNDRED AND SECOND payload served from https://willow-13.com/f/4nsri1yksbqlneewnevynq/cvfo3thd, fetched via Tor 2026-10-20 05:46:20 UTC, origin build time 05:05:31, 1 hour after the previous build (75e4994373a51dbfe5f22f0f071c05dbedd077d80aa6a0051374121780868707, built 04:05:26). Loader code differs from the previous build by function-level CFG match (fv_codehash REVIEW, TLSH of __text 184) and a payload table of 264,818 B plaintext against 268,034 B, but the wrapper moved with this build: Loader skeleton, import set and decrypt chain unchanged; the codehash REVIEW comes only from a function-count delta of 5 (47 vs 42, flattened bodies split into more pieces) at TLSH 184, inside the willow range of earlier repack-like builds. Same 57-handler stealer as build 101 (shape similarity 0.866, kept payload 264,818 B vs 268,034 B, identical path set, no new host, path or capability keyword), config still env-injected at run time. Not executed. VirusTotal: https://www.virustotal.com/gui/file/e01bd2a000cc1e1212ce7420b308a7a345dfef5efca112fa50cadf7a60594f3d Hybrid Analysis: https://hybrid-analysis.com/sample/e01bd2a000cc1e1212ce7420b308a7a345dfef5efca112fa50cadf7a60594f3d