ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hypothesis targets the presence of known ClearFake indicators, which are frequently leveraged by threat actors to deploy fake cryptocurrency wallets and execute financial fraud campaigns. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints or phishing artifacts early, enabling rapid containment before attackers can harvest sensitive credentials or initiate unauthorized transactions.

IOC Summary

Malware Family: ClearFake Total IOCs: 8 IOC Types: url, domain

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["pish-bini.bet", "xnjwhp5s.arayemek.com", "853vs3ju.honargrafi.com", "honargrafi.com", "earl.blinqueofficial.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://testingcf.jsdelivr.net/gh/dsteru3421/djjghryer46657l/gffdj5643", "https://testingcf.jsdelivr.net/gh/retwiry2536/djhgrgfd375654/hfgd645j", "https://testingcf.jsdelivr.net/gh/retwiry2536/8615c4a4bb56/ea21e91342e4"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A DevOps engineer uses curl or wget to download a specific ClearFake-related script or binary from a trusted internal artifact repository (e.g., Artifactory, Nexus) for testing or integration purposes, triggering the IOC match on the file hash or URL.
  • Filter/Exclusion: Exclude network connections or file creations where the source IP is within the internal CI/CD subnet range (e.g., 10.20.0.0/24) AND the destination path is under the designated build artifact directory (e.g., C:\Builds\ or /opt/artifacts/).
• Scenario: An endpoint protection platform (e.g., CrowdStrike Falcon, SentinelOne) or a vulnerability scanner (e.g., Qualys, Tenable) downloads a ClearFake-related test file or signature update to a temporary directory (%TEMP%, /tmp) for analysis or scanning, matching the IOC.
  • Filter/Exclusion: Exclude events where the process name is a known EDR agent (e.g., FalconSensor.exe, SentinelOne.exe) or scanner service (e.g., QualysAgent.exe) AND the file path contains standard temporary directories (%TEMP%, /tmp, C:\Windows\Temp\).
• Scenario: A scheduled maintenance job (e.g., a PowerShell script run via Task Scheduler) downloads a ClearFake-related configuration file or library from a trusted internal web server to a specific application directory (e.g., C:\Apps\MyApp\config\) for daily updates.
  • Filter/Exclusion: Exclude file creation events where the parent process is svchost.exe (Task Scheduler) or powershell.exe invoked by a known service account, AND the file path is under the specific application directory (e.g., `C:\Apps\MyApp