ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets adversary activity linked to the ClearFake malware campaign by correlating network and endpoint telemetry against a specific set of 79 known Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical because ClearFake’s high severity rating suggests an active, sophisticated threat that requires immediate identification to prevent lateral movement and data exfiltration before automated alerts trigger.

IOC Summary

Malware Family: ClearFake Total IOCs: 79 IOC Types: ip:port, url, sha256_hash, domain

Type	Value	Threat Type	First Seen	Confidence
domain	`39p49guo.mokatebatedari.xyz`	payload_delivery	2026-06-29	100%
domain	`dsr.bet1forward.com`	payload_delivery	2026-06-29	100%
domain	`idverification-cdn.info`	botnet_cc	2026-06-29	90%
domain	`1j4lxwuu[.]1xboropartners.com`	payload_delivery	2026-06-29	100%
domain	`backupper.pro`	botnet_cc	2026-06-29	90%
domain	`cdn.api-middle-connect.com`	botnet_cc	2026-06-29	90%
ip:port	`178[.]16[.]53[.]219:443`	botnet_cc	2026-06-29	90%
domain	`wiciauth.com`	botnet_cc	2026-06-29	90%
sha256_hash	`be32773534e3d4cd7618194949f7628882992f3dfb048c37f4c960505a005b1c`	payload	2026-06-29	90%
sha256_hash	`ada4690c212b7b983e65986c2528c9bdf7cff75589b043ee223a021465c43920`	payload	2026-06-29	90%
sha256_hash	`833e888570c0873e3ce1f026bf6fe7d5abdc0efdd9e55399084ec6fabe9df21b`	payload	2026-06-29	90%
sha256_hash	`0c86f5737476c1efc6dffed41e548e75ef9aa4b3dd36b59a30edd320bd65a429`	payload	2026-06-29	90%
sha256_hash	`c6d22ebf9dce5fef2d5f1d87b3007457ef3c6d0193f121305b3d14e85441b43f`	payload	2026-06-29	90%
sha256_hash	`5239a198297149ff5440bda18c94ce9c8cc2a2212bd95b3c4bedc197c1b9fb1c`	payload	2026-06-29	90%
sha256_hash	`550fe153238e6a8c2cc6cf6a882bdc853fa4bb00721ebf5e7eae863124fd316b`	payload	2026-06-29	90%
sha256_hash	`35f619453b4ab2c491b29d880c6bee8f3ae16700b293bbf31deeae975caa71c3`	payload	2026-06-29	90%
sha256_hash	`c2ee091e95cdc4b4d677e55dc361d76867367a771b540dade1c698a05a2d5f0d`	payload	2026-06-29	90%
sha256_hash	`ab101c1996f424300c3eddd06c10575585eeca9d2f7c892f3c45c50e9719c690`	payload	2026-06-29	90%
sha256_hash	`acf4462915e81d81deac3f8e34de6b8cee64cc30dd9f57945794ba0f6dd0a0a8`	payload	2026-06-29	90%
sha256_hash	`46a8a3d6131259e53ec07ac725c12dcf5a07d677ac35583982038ad397c19ad3`	payload	2026-06-29	90%
sha256_hash	`42624224dfce7a43fcb9d806db2082c30227a815478b1feb74e8cf8cb64f71d2`	payload	2026-06-29	90%
sha256_hash	`fa6e5f8bb72cc6b04bafe95f01d664b21c1654381b74154897c3efe32e01104b`	payload	2026-06-29	90%
sha256_hash	`2d32bf0acaaf5ab032313ec4476774390ebc084d9b8459afd284223fcfb6021d`	payload	2026-06-29	90%
sha256_hash	`3f6b065ed2f63b461f23880aee569b9522dd136c20c65bea450f305e9c93f22c`	payload	2026-06-29	90%
sha256_hash	`0c964ea5e7a7809b665aa2517d078d50020ddc3b0868f11dc77e625ceb9e9712`	payload	2026-06-29	90%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ClearFake
let malicious_ips = dynamic(["178.16.53.219"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["178.16.53.219"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["39p49guo.mokatebatedari.xyz", "dsr.bet1forward.com", "idverification-cdn.info", "1j4lxwuu.1xboropartners.com", "backupper.pro", "cdn.api-middle-connect.com", "wiciauth.com", "qiuy.org", "abt90shart.com", "yekshart.app", "1xbet.sex"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://rpc-cloud.beer/api/"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ClearFake
let malicious_hashes = dynamic(["be32773534e3d4cd7618194949f7628882992f3dfb048c37f4c960505a005b1c", "ada4690c212b7b983e65986c2528c9bdf7cff75589b043ee223a021465c43920", "833e888570c0873e3ce1f026bf6fe7d5abdc0efdd9e55399084ec6fabe9df21b", "0c86f5737476c1efc6dffed41e548e75ef9aa4b3dd36b59a30edd320bd65a429", "c6d22ebf9dce5fef2d5f1d87b3007457ef3c6d0193f121305b3d14e85441b43f", "5239a198297149ff5440bda18c94ce9c8cc2a2212bd95b3c4bedc197c1b9fb1c", "550fe153238e6a8c2cc6cf6a882bdc853fa4bb00721ebf5e7eae863124fd316b", "35f619453b4ab2c491b29d880c6bee8f3ae16700b293bbf31deeae975caa71c3", "c2ee091e95cdc4b4d677e55dc361d76867367a771b540dade1c698a05a2d5f0d", "ab101c1996f424300c3eddd06c10575585eeca9d2f7c892f3c45c50e9719c690", "acf4462915e81d81deac3f8e34de6b8cee64cc30dd9f57945794ba0f6dd0a0a8", "46a8a3d6131259e53ec07ac725c12dcf5a07d677ac35583982038ad397c19ad3", "42624224dfce7a43fcb9d806db2082c30227a815478b1feb74e8cf8cb64f71d2", "fa6e5f8bb72cc6b04bafe95f01d664b21c1654381b74154897c3efe32e01104b", "2d32bf0acaaf5ab032313ec4476774390ebc084d9b8459afd284223fcfb6021d", "3f6b065ed2f63b461f23880aee569b9522dd136c20c65bea450f305e9c93f22c", "0c964ea5e7a7809b665aa2517d078d50020ddc3b0868f11dc77e625ceb9e9712", "d18d2f76bc553fdecc640c00a548602979c0fcc281b5a626d394937951896822", "1fd793fc4db29dd42133cb20ea217f29b036d6d0a18d1753ebe56f4544537c32", "d92133d8434307a99c4c5bbbc905e65c330b38fe991fdcb5b14bd26f70333df9", "5071b6b49624a35b28f6cc66537be58e76daf2fa3de33a1b106bbd1c7c07561d", "b481fa88ec61057add0348646d4c703bf7ee3cfc3c98c8547371e6f3cd2ad0b9", "d0ab588b2b93e141b7dc39722f92711dd2de0ae5ad0e764f957ba01f92155820", "cd94f3a58d58d6c3e5c317fae03cc845d2368c42dba736386c1699c4c157d7f3", "9623feb7944da035d38aa653477951b809b4a1c2f6500cd20dd0492889b776f8", "8aaed4d47ae246059967342ee86a0420793c5751dcf86730e8800f31e26ec866", "c43c3397154a1f2d89b34cc4122842c2abbfeab139486e55e1e2b71b978959cf", "9afbc96639fa400657630e2a3cf4e021a0ab685215b18a03b808e9f27f19fac7", "55abd984d38cf05764b4c7ac4d636dfb827a379be7c975aae6d0a88d545fdf25", "7448dccda7b3a82c715869498870f0d0216b31f015fc1324aadf73636a9f0af1", "876f875e31e95dfc8b592594f17e6da1a271293de61fade030ea679b815ca817", "f95432faa54a492129454056a396b4b31b5211899d0f9611bee7189661ca3188", "3ed8020622796f70bdf3c16de772b8b45bb542f0af0d9fb639b1513c5c722b53", "3e2820527d8eb9a5396cc533f976a929ceb016168a5bce6150fc3ba061e04218", "4d24fab4342c0b19a2ea0d0ca36392f4053331ce57deeb7115eb34aeb35313ca", "6b3f8442d21103d11bb232c3dfb1dcbac8c576f3e4094c0542baed6b3e4fb657", "75c3961a5e1e88b1d8599111df547fe8bec37388eede78f121568417de635ffb", "8bfc5d83dd86d69937a22a091d8aacafbbf0fa7f0c7faa34674fccb1e5b6b657", "4004d3a14a3c7810c44b363927adea33cd55f4a28f6f0baacd937021fc8ed563", "6103c24bf10fa4e282d27d63c38934d66bf999b81eb880b9e5761da6496dd575", "efa24e6d66c558ef12539fbf615c8a607181e676b4da98e96203910fb9cc0e61", "af387603dc23f60d2bcd1269e6a1b18f4dceb90575f44b15b36e9c04170f14c8", "02e0fb035d480b199f0f2173ed4a8a7b8d6b8340bda05a2af7a20b166a716fe0", "18338778e3114e19b28f64e4c1bf9d4ccf0cfc4b2783b46b86862fb6bab12a80", "201c5e3d0a94d4ebe356e8280f430f87bdf6d04d8116aac59e04d7ee3951bae5", "627867b7897597d74d64f2f722771b87df1796f8a7e7bbff2e0941d25da96a87", "a2009f634a5dec6911655bb282d95487bf53100a72c70a62e56044a31594aefd", "425607e394b6da612043b6d91e485c3c4b12910af1c27c1df41397b59d832096", "e021ef11104505f017fad54273c00d29bf87f537dd102c6fc2f519f8bc6e3f64", "7c8f07dabe3eedee00f7de27fabc5689b699ea7c932c9c29bde9f5c3e59f9fd7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceFileEvents`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`DnsEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs rule, tailored for an enterprise environment using the Hunt detection package:

Endpoint Protection Management Console Updates
- Scenario: The centralized management server (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) automatically downloads and distributes definition updates containing ClearFake indicators to thousands of agents. This generates massive network traffic and file creation events matching the 79 IOCs across the entire infrastructure, mimicking a widespread infection rather than an update cycle.
- Filter/Exclusion: Exclude traffic originating from the specific IP subnets assigned to Endpoint Management Servers (e.g., 10.20.50.x) and filter events where the process name matches known management agents (e.g., MsSense.exe, CrowdStrikeService.exe).
Scheduled Vulnerability Scanning Jobs
- Scenario: Enterprise vulnerability scanners (such as Tenable Nessus, Qualys, or Rapid7 InsightVM) run nightly scans that actively probe systems for known threats. During these scans, the scanner’s engine queries internal repositories and generates logs referencing ClearFake signatures to validate detection baselines, triggering alerts on every scanned host.
- Filter/Exclusion: Create a rule exclusion based on the source process name of the vulnerability scanner (e.g., TenableAgent.exe, QualysPCAgent) and restrict alerting to business hours or specific maintenance windows when these scans are known to execute.
IT Asset Discovery and Inventory Tools
- Scenario: Automated discovery tools like Lansweeper, SCCM (System Center Configuration Manager), or ServiceNow Discovery Agents perform periodic sweeps of the network. These agents often download reference datasets containing ClearFake IOCs to cross-reference against installed software versions on workstations and servers, causing legitimate file access and DNS resolution events that match the detection logic