161.35.146[.]120IP address
Reported by 2 independent sources · first reported by Palo Alto Unit 42 · last reported
Last reported 1 month agoFeeds last saw it 22 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Atomic macOS (AMOS) Stealer Activity“Post-infection traffic consisted mainly of HTTP POST requests to a command and control (C2) server at 161.35.146[.]120.”
Seen in threat feeds
1 feed| Feed | First seen | Last seen | Sightings | What the feed says |
|---|---|---|---|---|
| abuse.ch ThreatFox | 1 | botnet_cc · AMOS · AccountsHelper · AMOS · ClickFix · Foxveil · macOS |
Indicators reported together
named in the same reports- hxxps://ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688in 1 report
- ferncore13[.]comin 1 report
- 188.166.78[.]138in 1 report
- 71781ad8adefb499…5c76d8cde88cin 1 report
- 7ea6ff8b12c59aaa…154d40d7ca3ain 1 report
- a598fcdcd4924731…d276668fa2a9in 1 report
- 6bfcdb4920383375…b82478012620in 1 report
- 4504006d1911057b…deba6cf667b9in 1 report
- hxxps://getmacouscloud[.]comin 1 report
- getmacouscloud[.]comin 1 report
- hxxps://grove-89[.]com/api/metrics/run?event=pastedin 1 report
- grove-89[.]comin 1 report
- hxxps://ferncore13[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/updatein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.