ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the ClearFake malware campaign by actively searching for network and endpoint interactions matching its specific set of 37 known Indicators of Compromise (IOCs). Proactively hunting these IOCs in Azure Sentinel is critical to identify early-stage infections that may evade standard signature-based detection, allowing the SOC team to rapidly contain lateral movement before data exfiltration occurs.

IOC Summary

Malware Family: ClearFake Total IOCs: 37 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	nxyhlvha.fileboroo.com	payload_delivery	2026-07-15	100%
domain	pcipjcar.fileboroo.com	payload_delivery	2026-07-15	100%
domain	i6s46ndy.site-takhtenard-sharti-betland.com	payload_delivery	2026-07-15	100%
domain	mgnj.behtarin-site-shartbandi-football.com	payload_delivery	2026-07-15	100%
domain	litwpjrq.casinomhub.bet	payload_delivery	2026-07-15	100%
domain	j1xayyip.bordbett10.com	payload_delivery	2026-07-15	100%
domain	frqbuzgo.bingobet.bingo	payload_delivery	2026-07-15	100%
domain	mpygi.jadoou.space	payload_delivery	2026-07-15	100%
domain	ycrarqcd.bingobet.bingo	payload_delivery	2026-07-15	100%
domain	078zq932.betyek.bio	payload_delivery	2026-07-15	100%
domain	0rlxki7g.bordbett10.com	payload_delivery	2026-07-15	100%
domain	bordbett10.com	payload_delivery	2026-07-15	100%
domain	vjs8k4dd.betyek.bio	payload_delivery	2026-07-15	100%
domain	betyek.bio	payload_delivery	2026-07-15	100%
domain	brmzm.jadoou.space	payload_delivery	2026-07-15	100%
domain	cgzt.behtarin-site-shartbandi-football.com	payload_delivery	2026-07-15	100%
domain	krdqfpte.bingobet.bingo	payload_delivery	2026-07-15	100%
domain	nkqj.behtarin-site-shartbandi-football.com	payload_delivery	2026-07-15	100%
domain	zxpimegb.bingobet.bingo	payload_delivery	2026-07-15	100%
domain	xnshgwgf.bingobet.bingo	payload_delivery	2026-07-15	100%
domain	jw27s0al.site-takhtenard-sharti-betland.com	payload_delivery	2026-07-15	100%
domain	hcnmjrat.bingobet.bingo	payload_delivery	2026-07-15	100%
domain	izehzccr.bet90forward.win	payload_delivery	2026-07-15	100%
domain	mhyp.bahigo90bet.com	payload_delivery	2026-07-15	100%
domain	wxxlppea.onjabet1.com	payload_delivery	2026-07-15	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["nxyhlvha.fileboroo.com", "pcipjcar.fileboroo.com", "i6s46ndy.site-takhtenard-sharti-betland.com", "mgnj.behtarin-site-shartbandi-football.com", "litwpjrq.casinomhub.bet", "j1xayyip.bordbett10.com", "frqbuzgo.bingobet.bingo", "mpygi.jadoou.space", "ycrarqcd.bingobet.bingo", "078zq932.betyek.bio", "0rlxki7g.bordbett10.com", "bordbett10.com", "vjs8k4dd.betyek.bio", "betyek.bio", "brmzm.jadoou.space", "cgzt.behtarin-site-shartbandi-football.com", "krdqfpte.bingobet.bingo", "nkqj.behtarin-site-shartbandi-football.com", "zxpimegb.bingobet.bingo", "xnshgwgf.bingobet.bingo", "jw27s0al.site-takhtenard-sharti-betland.com", "hcnmjrat.bingobet.bingo", "izehzccr.bet90forward.win", "mhyp.bahigo90bet.com", "wxxlppea.onjabet1.com", "pnsc.radioshartbandi.bet", "kavfquba.onjabet1.com", "qds1jo2q.site-shartbandi-pasor.online", "pdzb.pdfbama.com", "sdtawdiq.niliafshar.com", "niliafshar.com", "mprwjkek.betwanaa.com", "umnb.daddybetiran.live", "a9fh521j.bazisangkaqazgeychidancepoli.com", "kc2m8580.booro.bet", "1og90icd.betyek.app", "booro.bet"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, tailored for a legitimate enterprise environment:

• Endpoint Protection Policy Updates via Microsoft Defender for Endpoint

  • Scenario: The security team deploys a new definition update or policy configuration to all managed workstations. This process triggers the download and execution of multiple ClearFake-related hash values (IOCs) as part of the signature database refresh, which mimics the behavior of an active threat scan.
  • Suggested Filter/Exclusion: Exclude network traffic and file hashes originating from the Microsoft Defender Antivirus service executable (MsMpEng.exe) or restrict the rule to only alert on IOCs detected outside of the standard maintenance window (e.g., 02:00–04:00 UTC) when these updates are scheduled.

• Automated Vulnerability Scanning with Tenable Nessus

  • Scenario: A scheduled weekly vulnerability scan is executed by a Tenable Nessus agent on critical servers. The scanner actively probes the system for known threats, generating network connections and file reads that match the 37 ClearFake IOCs as part of its baseline assessment logic.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the source IP addresses assigned to the internal vulnerability scanning infrastructure (e.g., 10.x.x.x range for Tenable agents) or filter events where the process name matches Nessus Agent (TmAgent.exe).

• Group Policy Object (GPO) Deployment of Security Scripts

  • Scenario: An administrator pushes a new Group Policy containing PowerShell scripts designed to harden workstations. These scripts reference ClearFake IOC lists to validate system integrity, causing the local script engine to generate events that trigger the detection logic during the next user logon or system boot cycle.