279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92SHA-256 hash
Reported by 2 independent sources · first reported by Cisco Talos · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation“279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 Talos clipper archive; extracted payload classified as AnimateClipper”
-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“The most recently observed response was a ZIP archive, SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92.”
Indicators reported together
named in the same reports- verification[.]googlein 1 report
- pf[.]chin 1 report
- leaguejazire[.]comin 1 report
- riyazinikokar[.]xyzin 1 report
- hxxps://telegra[.]ph/Functions-04-03in 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- lb.propertyfind[.]ccin 1 report
- fd.gstats-api-contact[.]ccin 1 report
- pkg.vogueatelier[.]ccin 1 report
- kffd3.vogueatelier[.]ccin 1 report
- kffd3.vexlatech[.]ccin 1 report
- static.quorashift[.]ccin 1 report
- 643ef35536ff9273…44b02131b205in 1 report
- 1819827e17f31e72…da9f24179b25in 1 report
- update.dubbedmuch[.]ccin 1 report
- hxxps://kr.cedar2glanz[.]ru/jewel.jsin 1 report
- kr.cedar2glanz[.]ruin 1 report
- hxxps://phys.stunned-amniotic[.]com/hub.login 1 report
- phys.stunned-amniotic[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.