← Back to SOC feed Coverage →

ThreatFox: ClearFake IOCs

ioc-hunt HIGH ThreatFox
DnsEvents
iocjs-clearfakethreatfox
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-09T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt detects adversary activity involving the deployment of ClearFake malware by correlating network and endpoint telemetry against a curated set of 36 specific Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical to identify early-stage infections before they establish persistence or exfiltrate sensitive data, given the high severity associated with this threat family.

IOC Summary

Malware Family: ClearFake Total IOCs: 36 IOC Types: domain

TypeValueThreat TypeFirst SeenConfidence
domainbmmp.ace90betyek.betpayload_delivery2026-07-09100%
domainxfcv55u8.iraniporn.videopayload_delivery2026-07-09100%
domainiraniporn.videopayload_delivery2026-07-09100%
domainkuqetgql.shartebartar.gamepayload_delivery2026-07-09100%
domainshartebartar.gamepayload_delivery2026-07-09100%
domainwfwwdsvv.irantop.betpayload_delivery2026-07-09100%
domainlptgdpfh.irantop.betpayload_delivery2026-07-09100%
domaingloxntzt.hazzaratbet.compayload_delivery2026-07-09100%
domainpcue.elitesport.irpayload_delivery2026-07-09100%
domainwvew.elitesport.irpayload_delivery2026-07-09100%
domainoulkepos.nikansefile.irpayload_delivery2026-07-09100%
domainnzapybzk.nikansefile.irpayload_delivery2026-07-09100%
domainjnfj.elitesport.irpayload_delivery2026-07-09100%
domainduqvs764.likesport.irpayload_delivery2026-07-09100%
domainlikesport.irpayload_delivery2026-07-09100%
domainq8nw6zme.fileboroo.compayload_delivery2026-07-09100%
domainuuh7n2c4.fileboroo.compayload_delivery2026-07-09100%
domainfqsmqhyz.mosbatsms.irpayload_delivery2026-07-09100%
domainiclcyezy.mosbatsms.irpayload_delivery2026-07-09100%
domainaapt.betsher.casinopayload_delivery2026-07-09100%
domainncvhdwcq.medsalamat.irpayload_delivery2026-07-09100%
domainxaqjwwmj.medsalamat.irpayload_delivery2026-07-09100%
domaintrlcayaw.matalebeziba.irpayload_delivery2026-07-09100%
domainmatalebeziba.irpayload_delivery2026-07-09100%
domainsysvert7holz.dexispointnexus.gardenbotnet_cc2026-07-0990%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["bmmp.ace90betyek.bet", "xfcv55u8.iraniporn.video", "iraniporn.video", "kuqetgql.shartebartar.game", "shartebartar.game", "wfwwdsvv.irantop.bet", "lptgdpfh.irantop.bet", "gloxntzt.hazzaratbet.com", "pcue.elitesport.ir", "wvew.elitesport.ir", "oulkepos.nikansefile.ir", "nzapybzk.nikansefile.ir", "jnfj.elitesport.ir", "duqvs764.likesport.ir", "likesport.ir", "q8nw6zme.fileboroo.com", "uuh7n2c4.fileboroo.com", "fqsmqhyz.mosbatsms.ir", "iclcyezy.mosbatsms.ir", "aapt.betsher.casino", "ncvhdwcq.medsalamat.ir", "xaqjwwmj.medsalamat.ir", "trlcayaw.matalebeziba.ir", "matalebeziba.ir", "sysvert7holz.dexispointnexus.garden", "1xpin.com", "akvy.20sport.ir", "1xpin.co", "mdazhynx.btyek.site", "dtka7mx6.btyek.site", "cniqfzhe.riskybet.casino", "cztv.betfa.download", "snbzg3fu.noscriptc11pills.com", "noscriptc11pills.com", "xqbhmyyk.powershart.com", "zirq.bet24.casino"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel TableNotes
DnsEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 4 specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

Original source: https://threatfox.abuse.ch/browse/malware/js.clearfake/