ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 0ba66af8e4fa28326efd2fea2fd2c0990ddc37cc01751ce093f12ed4ae0e9d58.

Database Entry

IOC ID:	2001844
IOC:	0ba66af8e4fa28326efd2fea2fd2c0990ddc37cc01751ce093f12ed4ae0e9d58
IOC Type :	sha256_hash
Threat Type :	payload
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
First seen:	2026-10-29 18:38:39 UTC
Last seen:	never
UUID:	f53276c8-d3c7-11f1-a74e-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos ClickFix Foxveil macOS nuyar
Reference:	https://hybrid-analysis.com/sample/0ba66af8e4fa28326efd2fea2fd2c0990ddc37cc01751ce093f12ed4ae0e9d58

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 2,004,384 B), the EIGHTY-FOURTH payload served from https://chant66.com/f/nt5ax1_btyoxzizb9whm9q/nuyar9lb, fetched via Tor 2026-10-29 14:14:44 UTC, origin build time 14:02:10, 1 hour after the previous build (a307feab2a2063b2cc2d5a7d199beca0909bb17c9b42207b20793098da7a7e8f). Same loader family as the previous build (47 __text functions against 47, TLSH of __text 62, inside the 11 to 128 band measured between builds of this family) and a payload table of 264,322 B plaintext against 266,702 B: a scheduled repack of the same AMOS stealer. Not executed.Hybrid Analysis: https://hybrid-analysis.com/sample/0ba66af8e4fa28326efd2fea2fd2c0990ddc37cc01751ce093f12ed4ae0e9d58