643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205SHA-256 hash
Reported by 1 independent source · first reported by Cisco Talos · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“The URL for the second secondary payload of the "pf.ch" branch yielded a binary shellcode blob with SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205.”
Indicators reported together
named in the same reports- verification[.]googlein 1 report
- pf[.]chin 1 report
- leaguejazire[.]comin 1 report
- riyazinikokar[.]xyzin 1 report
- hxxps://telegra[.]ph/Functions-04-03in 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- 279d04c0cfd700c8…772739aecb92in 1 report
- lb.propertyfind[.]ccin 1 report
- fd.gstats-api-contact[.]ccin 1 report
- pkg.vogueatelier[.]ccin 1 report
- kffd3.vogueatelier[.]ccin 1 report
- kffd3.vexlatech[.]ccin 1 report
- static.quorashift[.]ccin 1 report
- 1819827e17f31e72…da9f24179b25in 1 report
- update.dubbedmuch[.]ccin 1 report
- hxxps://kr.cedar2glanz[.]ru/jewel.jsin 1 report
- kr.cedar2glanz[.]ruin 1 report
- hxxps://phys.stunned-amniotic[.]com/hub.login 1 report
- phys.stunned-amniotic[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.