Skip to main content

AMOS

Malware Family

697 indicators of compromise attributed to AMOS across abuse.ch threat intelligence feeds.

Domains

165

IPs

16

URLs

98

Hashes

418

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (165)IPs (16)URLs (98)Hashes (418)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
amber-22.comdomain
leaflyric4.comdomain
shoreharbor9.comdomain
current99.comdomain
weave44.comdomain
inktapestry.comdomain
update-check.comdomain
2hnjv5o9tq18x.xyzdomain
verse-18.comdomain
lyricblaze9.comdomain
bronzeverse9.comdomain
2t8cpyvwbhcze.appdomain
basequill9.comdomain
d9mjs.sbsdomain
hbomax-macos.comdomain
bloomglow9.comdomain
quartzsatin.comdomain
ballad82.comdomain
j56d50s1q53v.comdomain
quillchant14.comdomain
192.162.199.249ip
161.35.146.120ip
159.223.216.143ip
193.188.22.148ip
86.54.25.202ip
167.71.70.184ip
188.166.83.118ip
164.90.161.147ip
165.232.73.74ip
104.248.194.193ip
206.189.104.97ip
152.42.143.45ip
196.251.107.171ip
193.233.210.226ip
199.91.221.4ip
178.16.54.55ip
https://loop-lumen.com/zxc/app.zipurl
https://plume-compass.com/curl/raqq075kh1uc/mjeuiaspju450be1gn74aj1d.jsonurl
https://lyricblaze9.com/N_8qoQC3gmx9CFmwN9nMJ4QoUZtKZ1ua1ThNulPR4kU/brew/updateurl
https://stratos-delta.com/curl/925zai5h/ygpst74xbzykss9mw.daturl
http://192.162.199.249/tzb10mmujurnurl
http://178.16.54.55/Lavagaluhurl
https://aspenriver6.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/oo9/updateurl
http://192.162.199.249/ezaenul9url
https://lyric-8.com/api/metrics/run?event=pastedurl
https://ember-bridge.com/zyeMb6slon_3VWVlkSkdiJurcyhY5cFNtchnavRnMgU/cleaner3/updateurl
https://quill-flint.com/zyeMb6slon_3VWVlkSkdiJurcyhY5cFNtchnavRnMgU/jetbrains/updateurl
https://trekworkshop3.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/oo9/updateurl
https://loop-lumen.com/zxc/appex.zipurl
http://178.128.253.92/api/metrics/runurl
https://bronzeverse9.com/curl/xwehzkkycprx/update.shurl
https://linen-harbor.com/curl/rnulrjfa/init.shurl
https://quillchant14.com/f/680apd_597afiqvimxvelw/sfjwmrjyurl
https://pewweepor092.com/gate/ledgerlive-asarurl
http://178.16.54.55/Wuvululeurl
https://chantfern11.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/sss2/updateurl
839a4a3cae541999fcf9c1d73af84e6ae2dbdc588a9adf9f889e77d64a0e2d91hash
9d218a2bfff89d088666bdf8bb5f5bcf00894d82a729f02d00dd7ec0c7097c09hash
d39857fb92a0b6dc3c5da29dceb2cd92adf5b32da2d601893f0200adae7cc1e8hash
b92a53b7853807b3f417e8aaab19662f3451480743c3fc6831b8131a5859bfcehash

Another file to check? Run a file hash reputation check.