ThreatFox: Amatera IOCs | SOC Hunt Feed

Hunt Hypothesis

This hypothesis targets the Amatera backdoor, which adversaries deploy to establish persistent access, exfiltrate sensitive data, and facilitate lateral movement across compromised network segments. Proactively hunting for these IOCs in Azure Sentinel is critical to identify stealthy footholds before they are leveraged for deeper intrusion or data theft.

IOC Summary

Malware Family: Amatera Total IOCs: 4 IOC Types: sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205`	payload	2026-09-09	50%
sha256_hash	`1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25`	payload	2026-09-09	50%
sha256_hash	`279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92`	payload	2026-09-09	50%
sha256_hash	`bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b`	payload	2026-09-09	50%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Amatera
let malicious_hashes = dynamic(["643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205", "1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25", "279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92", "bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — Amatera

False Positive Guidance

Scenario: A DevOps engineer uses curl or wget to download a specific Amatera sample hash from a trusted internal artifact repository (e.g., Artifactory or Nexus) for vulnerability testing or threat hunting purposes.
- Filter/Exclusion: Exclude alerts where the source IP is within the internal 10.0.0.0/8 range AND the user account belongs to the devops or security-research group.
Scenario: An automated CI/CD pipeline (e.g., Jenkins or GitLab CI) executes a build step that downloads a dependency package containing a known Amatera IOC hash from a public registry like PyPI or npm, which is then cached locally on the build agent.
- Filter/Exclusion: Exclude alerts triggered by service accounts named ci-runner, build-agent, or pipeline-service when the process tree includes jenkins, gitlab-runner, or docker.
Scenario: A security analyst performs a manual threat hunt by executing a known Amatera beacon script from a staging server to verify detection coverage, using a dedicated test account.
- Filter/Exclusion: Exclude alerts where the user account is sec-test or threat-hunt AND the source host is in the staging or lab subnet.
Scenario: A legacy application server runs a scheduled cron job that fetches a configuration file from an external vendor’s update server, which coincidentally shares a network IOC (e.g., specific domain or IP) with the Amatera C2 infrastructure due to a shared hosting provider.
- Filter/Exclusion: Exclude alerts where the process is cron or systemd AND the destination domain is in the allowlisted vendor list (e.g., vendor-updates.com) AND the user is `