ThreatFox IOC Database

c4ffeine

Foxveil/AMOS reflective loader Mach-O (fat x86_64+arm64, 6,694,928 B), the FOUR HUNDRED AND FIFTY-FIRST payload served from https://swiftonyx16.com/f/ujkfbdvkl5i2ezacchx7ia/6b4aghms, fetched via Tor 2026-11-06 09:09:47 UTC, origin build time 09:01:56, 59 minutes after the previous build (698bf50c04302a77a5a1befeaa63a8b2368c7f89003a26aab1250d2714a2bdad, built 08:01:59). Same loader family as the previous build by function-level CFG match (TLSH of __text 190, above the 11 to 128 band measured between earlier builds of this family, while the per-function CFG match still reads repack-like) and a payload table of 1,961,563 B plaintext against 1,792,176 B, but the wrapper moved with this build: Key search timed out because the PBKDF2 count (81920) is now a shifted cmp immediate our profiler does not collect; with it the key opens in 0.3 s and handlers 57/57, kept size +2.1 % net of the bulk literal, no new hosts. Stealer unchanged vs build 450: same handler count, statement similarity 0.854, same paths, config still env-injected. Not executed. VirusTotal: https://www.virustotal.com/gui/file/210ec3057ebeb16d8a63dae497201bfd7a114b75445fff59ff73f7562c3e7812 Hybrid Analysis: https://hybrid-analysis.com/sample/210ec3057ebeb16d8a63dae497201bfd7a114b75445fff59ff73f7562c3e7812