ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets adversary activity linked to the ClearFake campaign by correlating Azure Sentinel logs against a specific set of 39 known Indicators of Compromise (IOCs). Proactively hunting for these signatures is critical because ClearFake’s high-severity threat profile suggests active exploitation, requiring immediate detection and containment before lateral movement occurs within the environment.

IOC Summary

Malware Family: ClearFake Total IOCs: 39 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	zxx1gpmw.pars90.download	payload_delivery	2026-07-13	100%
domain	pars90.download	payload_delivery	2026-07-13	100%
domain	ovcvaphj.jadoou.cfd	payload_delivery	2026-07-13	100%
domain	vnuhxmfp.jadoou.cfd	payload_delivery	2026-07-13	100%
domain	zxco.madgal.life	payload_delivery	2026-07-13	100%
domain	ukgf.madgal.life	payload_delivery	2026-07-13	100%
domain	5ufm19dl.pdfbama.com	payload_delivery	2026-07-13	100%
domain	ikjsbyby.pdfbama.com	payload_delivery	2026-07-13	100%
domain	qcancmnq.jadoou.store	payload_delivery	2026-07-13	100%
domain	yyigpwsf.jadoou.store	payload_delivery	2026-07-13	100%
domain	vfld.jadoou.my	payload_delivery	2026-07-13	100%
domain	jadoou.my	payload_delivery	2026-07-13	100%
domain	zjyozhki.jadoou.space	payload_delivery	2026-07-13	100%
domain	rdywfklo.jadoou.space	payload_delivery	2026-07-13	100%
domain	gcyp.jadoou.monster	payload_delivery	2026-07-13	100%
domain	23euhdso.deryuga-sablist.garden	botnet_cc	2026-07-13	90%
domain	jadoou.monster	payload_delivery	2026-07-13	100%
domain	63mkau.deryuga-sablist.garden	botnet_cc	2026-07-13	90%
domain	sol-forgeen.deryuga-sablist.garden	botnet_cc	2026-07-13	90%
domain	cacbvgql.jadoou.skin	payload_delivery	2026-07-13	100%
domain	jadoou.skin	payload_delivery	2026-07-13	100%
domain	fahv2h6l.kimimaro-trance.com	payload_delivery	2026-07-13	100%
domain	jmwdyds9.kimimaro-trance.com	payload_delivery	2026-07-13	100%
domain	kimimaro-trance.com	payload_delivery	2026-07-13	100%
domain	l74u0.ima8invika.garden	botnet_cc	2026-07-13	90%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["zxx1gpmw.pars90.download", "pars90.download", "ovcvaphj.jadoou.cfd", "vnuhxmfp.jadoou.cfd", "zxco.madgal.life", "ukgf.madgal.life", "5ufm19dl.pdfbama.com", "ikjsbyby.pdfbama.com", "qcancmnq.jadoou.store", "yyigpwsf.jadoou.store", "vfld.jadoou.my", "jadoou.my", "zjyozhki.jadoou.space", "rdywfklo.jadoou.space", "gcyp.jadoou.monster", "23euhdso.deryuga-sablist.garden", "jadoou.monster", "63mkau.deryuga-sablist.garden", "sol-forgeen.deryuga-sablist.garden", "cacbvgql.jadoou.skin", "jadoou.skin", "fahv2h6l.kimimaro-trance.com", "jmwdyds9.kimimaro-trance.com", "kimimaro-trance.com", "l74u0.ima8invika.garden", "qcvuzme.ima8invika.garden", "tkhf.jadoou.mom", "omze.jadoou.mom", "jadoou.mom", "frqljktr.jadoou.site", "bsrqzaff.jadoou.site", "byagqv8a.fileboroo.com", "mlbn.jadoou.makeup", "jadoou.makeup", "sth4xz5f.pacificcrestforaging.com", "pacificcrestforaging.com", "knihrdel.jadoou.shop", "hruqsetf.jadoou.shop", "jadoou.shop"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule in an enterprise environment, along with recommended filtering strategies:

• Endpoint Security Agent Updates & Definition Syncs

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) automatically downloads and executes signature updates. These updates often include new hash values and network connections to vendor update servers that overlap with the 39 ClearFake IOCs, particularly if the threat intelligence feed has recently ingested benign vendor artifacts as “suspicious.”
  • Filter/Exclusion: Create an exclusion rule based on the specific process names of the EDR agents (e.g., csagent.exe, MsMpEng.exe) and restrict alerts to only trigger when these processes initiate connections outside of their standard update windows or to non-whitelisted IP ranges.

• Scheduled Backup and Data Replication Jobs

  • Scenario: Enterprise backup solutions like Veeam Backup & Replication or Commvault run nightly jobs that scan file systems, generate checksums, and transfer data over the network. If ClearFake IOCs include specific file hashes or network ports commonly used by these backup protocols (e.g., proprietary encryption ports or large file transfer patterns), the scheduled execution of these jobs will consistently trigger the rule during maintenance windows.
  • Filter/Exclusion: Implement a time-based filter to suppress alerts originating from known backup service accounts (e.g., svc_veeam, admin_backup) between 02:00 and 06:00 UTC, or exclude specific destination IP ranges associated with the organization’s cloud storage buckets.

• Patch Management Deployment Cycles

  • Scenario: During monthly patch cycles managed by tools like SCCM (Microsoft Configuration Manager) or Ivanti, deployment agents push updates to thousands of workstations and