6d6c646e664c595246466a4a64464a51MD5 hash
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
ClearFake's Variant: Web3 Exploitation for Malware Delivery“…iv=PMWks('/*aes-encrypted-payload*/');$WTbSz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((PMWks('6D6C646E664C595246466A4A64464A51')),[byte[]]::new(16)).TransformFinalBlock($HInQRiv,0,$HInQRiv.Length)); & $WTbSz.Substring(0,3) $WTbSz.Substring(3)”
Indicators reported together
named in the same reports- hxxps://start.cleaning-room-device[.]shop/sha589.m4ain 1 report
- start.cleaning-room-device[.]shopin 1 report
- hxxps://ai.fdswgw[.]shop/one.mp4in 1 report
- ai.fdswgw[.]shopin 1 report
- hxxps://mnjk-jk.bsdfg-zmp-q-n[.]shop/1.mp4in 1 report
- mnjk-jk.bsdfg-zmp-q-n[.]shopin 1 report
- hxxps://nbhg-v.iuksdfb-f[.]shop/ajax.mp3in 1 report
- nbhg-v.iuksdfb-f[.]shopin 1 report
- hxxps://hur.bweqlkjr[.]shop/m41.mp4in 1 report
- hur.bweqlkjr[.]shopin 1 report
- hbwzfr[.]runin 1 report
- hxxps://ty.klipxytozyi[.]shop/kangarooing.bmpin 1 report
- ty.klipxytozyi[.]shopin 1 report
- hxxps://raw.githubusercontent[.]com/Vincent-48/html/refs/heads/master/page.txtin 1 report
- hxxps://raw.githubusercontent[.]com/Vincent-48/html/refs/heads/master/TestLAB.exein 1 report
- hxxps://lapkimeow[.]icu/runin 1 report
- lapkimeow[.]icuin 1 report
- ert67-o9.pages[.]devin 1 report
- hxxps://f003.backblazeb2[.]com/file/skippp/uu.htmlin 1 report
- hxxps://f003.backblazeb2[.]com/file/skippp/index.htmlin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.