ThreatFox IOC Database

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 5,349,376 B), the FOUR HUNDRED AND SEVENTY-FIRST payload served from https://chantcompass9.com/f/yhzuuxkyytoc-pr6sqaaqa/lvitjpau, fetched via Tor 2026-11-05 13:22:37 UTC, origin build time 13:02:19, 59 minutes after the previous build (937fc818b39235ba246c3766c75e9c13c9261f5782cf63363335c2988d9647b4, built 12:02:20). Same loader family as the previous build by function-level CFG match (TLSH of __text 194, above the 11 to 128 band measured between earlier builds of this family, while the per-function CFG match still reads repack-like) and a payload table of 1,269,272 B plaintext against 262,910 B, but the wrapper moved with this build: Fleet-wide 13:00 rebuild added one unreferenced random base62 string literal of about 1 MB to the compiled payload; it accounts for the whole size growth and is filler. Same stealer as the previous build, 57 handlers, same literal multiset apart from random identifiers, same path set, env-injected config, no hosts in the sample. Not executed. VirusTotal: https://www.virustotal.com/gui/file/d71328730add09d2a9e75a7dc2301fe0cb6fc7e9ad8cc000c8679d48c166506f Hybrid Analysis: https://hybrid-analysis.com/sample/d71328730add09d2a9e75a7dc2301fe0cb6fc7e9ad8cc000c8679d48c166506f