Skip to main content

AMOS

Malware Family

1 476 indicators of compromise attributed to AMOS across abuse.ch threat intelligence feeds.

Domains

180

IPs

16

URLs

134

Hashes

1 146

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (180)IPs (16)URLs (134)Hashes (1 146)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
quest-22.comdomain
loop-lumen.comdomain
hugg1ngvx.topdomain
slate16.comdomain
226c6tcnujin1.appdomain
mpasvw.comdomain
se2lnidzfvts.orgdomain
bagueie.xyzdomain
tide-maple.comdomain
nsi8kw1r.loldomain
kitefeather5.comdomain
nimbus-pearl.comdomain
isosissisisossfiof.comdomain
mossmesh17.comdomain
raster-87.comdomain
aspenriver6.comdomain
journeylake11.comdomain
coral21.comdomain
data-hub-2312.comdomain
codex-craft.comdomain
192.162.199.249ip
161.35.146.120ip
159.223.216.143ip
193.188.22.148ip
86.54.25.202ip
167.71.70.184ip
188.166.83.118ip
164.90.161.147ip
165.232.73.74ip
104.248.194.193ip
206.189.104.97ip
152.42.143.45ip
196.251.107.171ip
193.233.210.226ip
199.91.221.4ip
178.16.54.55ip
https://leaf-core.com/api/metrics/run?event=stagerurl
https://quartzleap5.com/zyeMb6slon_3VWVlkSkdiJurcyhY5cFNtchnavRnMgU/jetbrains/updateurl
https://loop-lumen.com/zxc/app.zipurl
https://feather-24.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/code3/updateurl
https://loombronze.com/contacturl
https://lyricblaze9.com/N_8qoQC3gmx9CFmwN9nMJ4QoUZtKZ1ua1ThNulPR4kU/brew/updateurl
https://cedar-satin.com/zyeMb6slon_3VWVlkSkdiJurcyhY5cFNtchnavRnMgU/claude/updateurl
http://178.16.54.55/Lavagaluhurl
https://feed-delta.com/f/qus5n9iecneukfdd5bqagg/8d5wkyb6url
https://ember-bridge.com/zyeMb6slon_3VWVlkSkdiJurcyhY5cFNtchnavRnMgU/cleaner3/updateurl
http://161.35.146.120/contacturl
http://178.16.54.55/Cetoyojurl
https://raster-80.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/oo9/updateurl
https://willow-13.com/f/4nsri1yksbqlneewnevynq/cvfo3thdurl
http://178.16.54.55/Toyerujurl
https://rudder-moss.com/zxc/kitourl
http://142.93.131.83/api/metrics/runurl
https://chantcompass9.com/curl/ltlmtyrcu/3idd7eprmh6is0juh3.jsonurl
http://192.162.199.249/y6b3fuzj0w6pt97eurl
http://178.16.54.55/Sidaduburl
fa37b294832e59b0ce184a8f6685aa7aa99a1628723d269e4d6c801aa17dc472hash
3595b9bf0d67affa185f526b3f6ff18bd4166a53ea91f1a96acae245f6f5312chash
c6d4f1548ca208dce959f4d8bf6911568816eaca815457f5b3ddf7665ff46b1chash
b13de57505edea3858c69eddd66292767f12ac2296876ad075cfc9e34eca3a7chash

Another file to check? Run a file hash reputation check.