← Back to SOC feed Coverage →

ThreatFox: ClearFake IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
iocjs-clearfakethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-04T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt detects adversary activity involving the deployment of ClearFake malware by correlating Azure Sentinel telemetry against a specific set of 32 known Indicators of Compromise (IOCs). Proactively hunting for these signatures is critical to identify early-stage infections and mitigate potential data exfiltration or lateral movement before the threat escalates within the cloud environment.

IOC Summary

Malware Family: ClearFake Total IOCs: 32 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domainrxyvhv1x[.]1xforward.cashpayload_delivery2026-07-04100%
domain1xforward.cashpayload_delivery2026-07-04100%
domaingakvmew.tinybet.biopayload_delivery2026-07-04100%
domain1v2w5ogt.prozhe.shoppingpayload_delivery2026-07-04100%
domainprozhe.shoppingpayload_delivery2026-07-04100%
domaincgoucbv.thevallartasrestaurants.compayload_delivery2026-07-04100%
domainxxjbypq.takbetkade.compayload_delivery2026-07-04100%
domainwji9u2ff.fileecell.compayload_delivery2026-07-04100%
domainfileecell.compayload_delivery2026-07-04100%
domainoxepqya.btyek.autospayload_delivery2026-07-04100%
domainsevffjdu.jozveyek.compayload_delivery2026-07-04100%
domainjozveyek.compayload_delivery2026-07-04100%
domainfrfjuzh.btyek.cloudpayload_delivery2026-07-04100%
domainms9datqz[.]953.gamespayload_delivery2026-07-04100%
domain953.gamespayload_delivery2026-07-04100%
domainkwsgmru.btyek.clickpayload_delivery2026-07-04100%
domainbtyek.clickpayload_delivery2026-07-04100%
domain91qdl1ty[.]1xcart.cashpayload_delivery2026-07-04100%
domain1xcart.cashpayload_delivery2026-07-04100%
domainiu41zeaj[.]1xgame.vippayload_delivery2026-07-04100%
domain1xgame.vippayload_delivery2026-07-04100%
domainceohdvj.bonos.promopayload_delivery2026-07-04100%
domainvchbhqa.betbazi.netpayload_delivery2026-07-04100%
domainbetbazi.netpayload_delivery2026-07-04100%
domainq3g84ost[.]22beet.propayload_delivery2026-07-04100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["rxyvhv1x.1xforward.cash", "1xforward.cash", "gakvmew.tinybet.bio", "1v2w5ogt.prozhe.shopping", "prozhe.shopping", "cgoucbv.thevallartasrestaurants.com", "xxjbypq.takbetkade.com", "wji9u2ff.fileecell.com", "fileecell.com", "oxepqya.btyek.autos", "sevffjdu.jozveyek.com", "jozveyek.com", "frfjuzh.btyek.cloud", "ms9datqz.953.games", "953.games", "kwsgmru.btyek.click", "btyek.click", "91qdl1ty.1xcart.cash", "1xcart.cash", "iu41zeaj.1xgame.vip", "1xgame.vip", "ceohdvj.bonos.promo", "vchbhqa.betbazi.net", "betbazi.net", "q3g84ost.22beet.pro", "22beet.pro", "gefpeqd.bet1xiraq.com", "feeykse.betbacklink.com", "fituwzg.yek.autos", "yek.autos", "cxs9e097.vip1xbet.org", "kmkyfcu.winnerbahis-tr.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment, including suggested filters and exclusions:

Original source: https://threatfox.abuse.ch/browse/malware/js.clearfake/