ThreatFox IOC Database

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 1,872,704 B), the TWENTY-THIRD payload served from https://cube-60.com/f/3ouaaio6tobacvyfqoejza/sul9ec1i, fetched via Tor 2026-11-05 08:14:24 UTC, origin build time 08:02:49, 1 hour after the previous build (295a84833b35fe9084941df44138730aff1cf15f4bda9f6f5b9574630b892898). Same loader family as the previous build (45 __text functions against 47, TLSH of __text 243, above the 11 to 128 band measured between earlier builds of this family, while the per-function CFG match still reads repack-like) and a payload table of 268,902 B plaintext against 265,068 B: a scheduled repack of the same AMOS stealer. Not executed. Today's build of this series on MalwareBazaar: https://bazaar.abuse.ch/sample/3f6f292303c656d263f923ec29c628b981a54d769b18ad8c11570f23f0b2074f/