TF-MAL-apk.amplebot
📛 Threat Title
Malware family: AmpleBot
Description
ThreatFox malware family `apk.amplebot`. Printable name: AmpleBot. Aliases: BlackRock.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.amplebot
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.amplebot
IOC database
- Type
- domain
- Value
apk.amplebot- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.amplebot
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.amplebot
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (9)
-
web:bazaar.abuse.ch
Malware samples associated with tag amplebot MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with amplebot . Database Entry
-
web:cybernews.com
The FBI warns of a surge in ATM jackpotting attacks, with more than 700 incidents in 2025 alone. Hackers use Ploutus malware to force machines to dispense cash.
-
web:learn.microsoft.com
If your organization is using Defender for Endpoint (or Defender for Business), automated investigation and remediation capabilities can save your security operations team time and effort. As outlined in this blog post, these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats.
-
web:malpedia.caad.fkie.fraunhofer.de
This malware was initially named BlackRock and later renamed to AmpleBot .
-
web:openhunting.io
Interestingly, the Xerxes Trojan itself offers more features, but it seems that actors have removed some of them in order to only keep those that they consider useful to steal personal information. Note: This malware was initially named BlackRock and later renamed to AmpleBot .
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.pcrisk.com
The alert was accompanied by technical indicators of compromise (IOCs) and recommended mitigation practices aimed at financial institutions, law enforcement partners, and private cybersecurity teams. The mechanics of these attacks vary depending on the attacker's approach, but they all begin with physical access to the ATM.
-
web:www.thewindowsclub.com
Detect & find out if your computer is Bot infested & remove Botnet infection with these 11 Botnet Removal Tools & Software, available as free downloads.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.