ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hunt targets adversary activity linked to the ClearFake malware campaign by correlating network and endpoint telemetry against a specific set of 84 known Indicators of Compromise (IOCs). Proactively hunting for these signatures in Azure Sentinel is critical because ClearFake’s sophisticated evasion techniques require early detection beyond standard alerting to prevent lateral movement and data exfiltration before the infection spreads.

IOC Summary

Malware Family: ClearFake Total IOCs: 84 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	elng.jadoou.baby	payload_delivery	2026-07-12	100%
domain	jadoou.baby	payload_delivery	2026-07-12	100%
domain	mjbpgp3k.jadoou.cfd	payload_delivery	2026-07-12	100%
domain	jadoou.cfd	payload_delivery	2026-07-12	100%
domain	fibvhxte.bekabet.casino	payload_delivery	2026-07-12	100%
domain	ondgegtt.bekabet.casino	payload_delivery	2026-07-12	100%
domain	tgjg.jadoou.autos	payload_delivery	2026-07-12	100%
domain	jadoou.autos	payload_delivery	2026-07-12	100%
domain	rgklgdmw.jadoobet.click	payload_delivery	2026-07-12	100%
domain	jadoobet.click	payload_delivery	2026-07-12	100%
domain	acthwqwn.behtarin-site-shartbandi.com	payload_delivery	2026-07-12	100%
domain	ihosymvc.behtarin-site-shartbandi.com	payload_delivery	2026-07-12	100%
domain	9h5e0vbd.jadoou.club	payload_delivery	2026-07-12	100%
domain	jadoou.club	payload_delivery	2026-07-12	100%
domain	omwf.jadoou.art	payload_delivery	2026-07-12	100%
domain	jadoou.art	payload_delivery	2026-07-12	100%
domain	xmgonqda.jadoobet.xyz	payload_delivery	2026-07-12	100%
domain	jadoobet.xyz	payload_delivery	2026-07-12	100%
domain	tetz.site-shartbandi-khareji.com	payload_delivery	2026-07-12	100%
domain	htro.site-shartbandi-khareji.com	payload_delivery	2026-07-12	100%
domain	kokkpxut.jadoobet.vip	payload_delivery	2026-07-12	100%
domain	jadoobet.vip	payload_delivery	2026-07-12	100%
domain	qzl7oi7a.zaribbala.bet	payload_delivery	2026-07-12	100%
domain	plzm.onjabet1.com	payload_delivery	2026-07-12	100%
domain	uohs.onjabet1.com	payload_delivery	2026-07-12	100%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["elng.jadoou.baby", "jadoou.baby", "mjbpgp3k.jadoou.cfd", "jadoou.cfd", "fibvhxte.bekabet.casino", "ondgegtt.bekabet.casino", "tgjg.jadoou.autos", "jadoou.autos", "rgklgdmw.jadoobet.click", "jadoobet.click", "acthwqwn.behtarin-site-shartbandi.com", "ihosymvc.behtarin-site-shartbandi.com", "9h5e0vbd.jadoou.club", "jadoou.club", "omwf.jadoou.art", "jadoou.art", "xmgonqda.jadoobet.xyz", "jadoobet.xyz", "tetz.site-shartbandi-khareji.com", "htro.site-shartbandi-khareji.com", "kokkpxut.jadoobet.vip", "jadoobet.vip", "qzl7oi7a.zaribbala.bet", "plzm.onjabet1.com", "uohs.onjabet1.com", "ruuupkia.jadoobet.pro", "prmznhyt.jadoobet.pro", "winopenhaus4.zexorcloudsync.garden", "xywz.betraca.bet", "caeb.betraca.bet", "ichnwcqh.jadoobet.live", "enzccxnn.jadoobet.live", "vefzvud7.jadoou.bond", "jadoou.bond", "81ro1qyb.radioshartbandi.bet", "p2cl2uyk.radioshartbandi.bet", "proxyharbor.topm", "micfybfh.jadoobet.ink", "mdzt.behtarin-site-shartbandi-football.bet", "fnrok367.jadoobet.blog", "jadoobet.ink", "doqr.behtarin-site-shartbandi-football.bet", "jadoobet.blog", "rnjaeyqy.jadoobet.info", "jadoobet.info", "bjmd.bahsegel90.com", "bwch.bahsegel90.com", "5r48e4d3.betturkey.bet", "h3cyc1or.betturkey.bet", "yfekdkqg.jadoobet.forum"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ClearFake IOCs detection rule, tailored for an enterprise environment using real-world tools and administrative workflows:

• Scheduled Antivirus Definition Updates via WSUS

  • Scenario: The organization uses Windows Server Update Services (WSUS) to push security updates. During the nightly maintenance window, a scheduled job downloads and installs the latest ClearFake signature definitions across the fleet of Microsoft Defender for Endpoint agents. This mass deployment generates network traffic matching the 84 IOCs associated with ClearFake update servers, which the rule flags as potential threat activity rather than routine patching.
  • Suggested Filter: Exclude traffic originating from the internal WSUS server IP range (e.g., 10.20.5.0/24) and restrict the alert to only trigger if the destination port is not standard update ports (80, 443) or if the source is an external public IP during non-business hours without a corresponding change ticket.

• Third-Party SIEM Log Ingestion via Splunk Universal Forwarder

  • Scenario: The Security Operations Center utilizes Splunk Enterprise to aggregate logs from various endpoints. A dedicated Universal Forwarder service is configured to periodically query the ClearFake threat intelligence API to enrich log data with IOCs before indexing. This background polling process initiates connections to the 84 ClearFake IPs, triggering the detection rule repeatedly as it mimics an active scanning or beaconing behavior often associated with malware.
  • Suggested Filter: Create a whitelist for the specific Splunk Forwarder service accounts (e.g., svc-splunk-fwd) and exclude any process execution where the parent process is splunkd.exe or splunk-forwarder.exe, provided the destination IPs match the known ClearFake API endpoints.

• **Autom