Amos Stealer Chunked HTTP PUT Exfiltration via curl to C2 /gate Endpoint

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

This rule detects HTTP PUT requests with specific URL parameters ('buildtxd=', 'upload_id=', 'chunk_index=', 'total_chunks=') and a 'Mozilla/5.0' user agent, directed towards known malicious domains ('bestbuydomain.com', 'premierrentalpurchase.com'). This pattern is indicative of data exfiltration, potentially by malware uploading stolen data in chunks.