ThreatFox: AMOS IOCs

Hunt Hypothesis

This hunt targets the presence of eight known indicators of compromise associated with the AMOS malware family, which often leverages these artifacts to establish persistence or execute malicious payloads. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised assets early, potentially disrupting the AMOS campaign before it escalates to lateral movement or data exfiltration.

IOC Summary

Malware Family: AMOS Total IOCs: 8 IOC Types: url, sha256_hash

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - AMOS
let malicious_urls = dynamic(["https://jadeleap15.com/contact", "http://178.128.253.92/api/metrics/run", "https://rudder-moss.com/zxc/app.zip", "https://rudder-moss.com/zxc/apptwo.zip", "https://rudder-moss.com/zxc/appex.zip", "https://rudder-moss.com/zxc/kito", "https://rudder-moss.com/zxc/mdw"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - AMOS
let malicious_hashes = dynamic(["158e11946bf88b2de4cabca7ea6b07dde9232c903a3925a60a3fd947bf1017b2"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — AMOS

False Positive Guidance

• Scenario: A DevOps team uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a custom build of the AMOS framework for internal testing or as a dependency for a microservice, where the specific binary hash or network endpoint matches one of the 8 IOCs.
  • Filter/Exclusion: Exclude alerts originating from known CI/CD runner service accounts (e.g., svc-jenkins, github-actions-runner) or restrict the rule to non-production environments (e.g., exclude hosts tagged env:dev or env:test).
• Scenario: An endpoint protection agent (e.g., CrowdStrike Falcon, Carbon Black) or a vulnerability scanner (e.g., Tenable Nessus) performs a memory scan or file integrity check that temporarily loads the AMOS binary into memory or creates a temporary copy in a standard temp directory (C:\Temp, /tmp), triggering the file hash or memory pattern IOC.
  • Filter/Exclusion: Exclude processes where the parent process is a known EDR agent or scanner (e.g., FalconSensor.exe, cb.exe, nessus.exe) and the file path resides in standard temporary or cache directories.
• Scenario: A scheduled maintenance job (e.g., a PowerShell script or batch file run via Task Scheduler) executes the AMOS tool to perform log rotation, data archival, or database cleanup, where the tool’s network beacon or local file access matches the IOC.
  • Filter/Exclusion: Exclude alerts where the process is launched by Task Scheduler (Taskeng.exe) or schtasks.exe and the command line arguments contain known maintenance keywords (e.g., rotate, archive, cleanup, backup).
• Scenario: A developer on a workstation installs the AMOS library via a package manager (e.g., `npm install amos