ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Domain/URLs

leaguejazire.com

riyazinikokar.xyz

https://telegra.ph/Functions-04-03

metrics.demobunfiber.top

lb.propertyfind.cc

static.quorashift.cc

kffd3.vexlatech.cc

kffd3.vogueatelier.cc

pkg.vogueatelier.cc

fd.gstats-api-contact.cc

mgo.gstats-api-contact.cc

fd.gstats-api-contd.cc

xn--b1aluem3j.gstats-api-contd.cc

xn--i-ctbr1afp.gstats-api-contd.cc

xn--b1ahgbfifq.gstats-api-cont.co

sp13.gstats-api-cont.co

sp13.gstats-api-coni.co

sp1.gstats-api-coni.co

fd-api-zog.velqo7.co

fd-api-rop.velqo7.co

fd-api-irc.velqo7.co

fd-api-irs.velqo7.co

fd-api-iris.velqo7.co

wix.velqo7.co

wdx.velqo7.co

wdm.velqo7.co

wdm.unguidedfreewill.co

wdx.unguidedfreewill.co

sdx.unguidedfreewill.co

fgp.unguidedfreewill.co

jup.unguidedfreewill.co

dmt.unguidedfreewill.co

tnt.unguidedfreewill.co

paf.hugo-mapp.co

pf.hugo-mapp.co

fr.hugo-mapp.co

en.hugo-mapp.co

dau.hugo-mapp.co

doh.hugo-mapp.co

smart.hugo-mapp.co

br.hugo-lapp.co

pt.hugo-lapp.co

geo.estimator-undermostshelving.in.net

https://geo.estimator-undermostshelving.in.net/dc06681a3f4e

https://geo.estimator-undermostshelving.in.net/jquery.min.js

update.dubbedmuch.cc

wss://update.dubbedmuch.cc/

kr.cedar2glanz.ru

https://kr.cedar2glanz.ru/jewel.js

phys.stunned-amniotic.com

https://phys.stunned-amniotic.com/hub.log

paternal-angrily.com

https://www.mediafire.com/file_premium/uoixtb8zxevpi6e/vk_swiftshader_icd.dat/file

IP Address

150.241.94.112

45.150.34.2

145.249.109.147

212.118.56.166

Hash

88735b838a83428193d1909424d082339cc1a993a4f91a9df09f51c81c69f70a

9f7b6aa8bd4c726a9a8d4c2788814db417a21cf4a7f9de3e1fc2bca6203a4e14

10f411e530c7bd86583ce80977d795837d85bab6b3ecb01fe3f3d069cdaeca8e

20040a8d6389a1a638c39b5457f235b2c23efa8bbd9f98204db831d5e3dc9b66

15fea063a3ceba5e929536357d1e9e1b9f0326fcbec50d570c4583712b109d6f

c2256961d9b7704e2bb85ae9512b4c1ee75fea95532434230c93cd5e38ef8aa7

279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92

38e74ff8d5f02617ff8858d9094b455d4e999223c7f78726584690e7201d94b7

91c4e9537558ef4481e5ea29c785fd1bc3f162bb60e2fa313239957e4381cacf

87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff

643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205

1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25

7504898b17a9ce05eb9209128bcd0fb67d675a70c8c64f6f624d08b47b2fe3af

9aa88b8e5b298e78ebd55ad53d322efe4b26e6cb1fadf6e94ae258d62a3362e4

0d660045808528c0525313b148f649eb77a341a2a2f8c5641721551362aa73d0

0c9bb4ced6c55776b0b2b903b4f65f2653d5868214601a4dcceea27789701dd5

bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b

be028ac6299ce6c2870941c700fa1fb2581bfd4ee6c0c75e89c5da9cea73fe97

abd28aecb2d57660bcd9455333b84d289aa883eaf5cf15def1bf0feb35833aa2

93830d73ddf9665ae4d5665f1cebabd093646ed54356662e1b2a925bc2df681b

86fbce191248bcc124b1259a178d84216d713f4acd516f578c5f3fdccb01fa4a

264c87880f7afaeb02e0fa522db52294d5a4198ae97fcf67d9aace3474c1b62f

Detection Query 1 :

domainname like "https://phys.stunned-amniotic.com/hub.log" or url like "https://phys.stunned-amniotic.com/hub.log" or siteurl like "https://phys.stunned-amniotic.com/hub.log" or domainname like "https://www.mediafire.com/file_premium/uoixtb8zxevpi6e/vk_swiftshader_icd.dat/file" or url like "https://www.mediafire.com/file_premium/uoixtb8zxevpi6e/vk_swiftshader_icd.dat/file" or siteurl like "https://www.mediafire.com/file_premium/uoixtb8zxevpi6e/vk_swiftshader_icd.dat/file" or domainname like "wdx.unguidedfreewill.co" or url like "wdx.unguidedfreewill.co" or siteurl like "wdx.unguidedfreewill.co" or domainname like "doh.hugo-mapp.co" or url like "doh.hugo-mapp.co" or siteurl like "doh.hugo-mapp.co" or domainname like "kffd3.vexlatech.cc" or url like "kffd3.vexlatech.cc" or siteurl like "kffd3.vexlatech.cc" or domainname like "en.hugo-mapp.co" or url like "en.hugo-mapp.co" or siteurl like "en.hugo-mapp.co" or domainname like "tnt.unguidedfreewill.co" or url like "tnt.unguidedfreewill.co" or siteurl like "tnt.unguidedfreewill.co" or domainname like "https://geo.estimator-undermostshelving.in.net/jquery.min.js" or url like "https://geo.estimator-undermostshelving.in.net/jquery.min.js" or siteurl like "https://geo.estimator-undermostshelving.in.net/jquery.min.js" or domainname like "dmt.unguidedfreewill.co" or url like "dmt.unguidedfreewill.co" or siteurl like "dmt.unguidedfreewill.co" or domainname like "pkg.vogueatelier.cc" or url like "pkg.vogueatelier.cc" or siteurl like "pkg.vogueatelier.cc" or domainname like "fd-api-zog.velqo7.co" or url like "fd-api-zog.velqo7.co" or siteurl like "fd-api-zog.velqo7.co" or domainname like "https://telegra.ph/Functions-04-03" or url like "https://telegra.ph/Functions-04-03" or siteurl like "https://telegra.ph/Functions-04-03" or domainname like "br.hugo-lapp.co" or url like "br.hugo-lapp.co" or siteurl like "br.hugo-lapp.co" or domainname like "static.quorashift.cc" or url like "static.quorashift.cc" or siteurl like "static.quorashift.cc" or domainname like "update.dubbedmuch.cc" or url like "update.dubbedmuch.cc" or siteurl like "update.dubbedmuch.cc" or domainname like "xn--i-ctbr1afp.gstats-api-contd.cc" or url like "xn--i-ctbr1afp.gstats-api-contd.cc" or siteurl like "xn--i-ctbr1afp.gstats-api-contd.cc" or domainname like "fd.gstats-api-contd.cc" or url like "fd.gstats-api-contd.cc" or siteurl like "fd.gstats-api-contd.cc" or domainname like "wdm.unguidedfreewill.co" or url like "wdm.unguidedfreewill.co" or siteurl like "wdm.unguidedfreewill.co" or domainname like "wix.velqo7.co" or url like "wix.velqo7.co" or siteurl like "wix.velqo7.co" or domainname like "paternal-angrily.com" or url like "paternal-angrily.com" or siteurl like "paternal-angrily.com" or domainname like "leaguejazire.com" or url like "leaguejazire.com" or siteurl like "leaguejazire.com" or domainname like "wdm.velqo7.co" or url like "wdm.velqo7.co" or siteurl like "wdm.velqo7.co" or domainname like "smart.hugo-mapp.co" or url like "smart.hugo-mapp.co" or siteurl like "smart.hugo-mapp.co" or domainname like "pt.hugo-lapp.co" or url like "pt.hugo-lapp.co" or siteurl like "pt.hugo-lapp.co" or domainname like "https://geo.estimator-undermostshelving.in.net/dc06681a3f4e" or url like "https://geo.estimator-undermostshelving.in.net/dc06681a3f4e" or siteurl like "https://geo.estimator-undermostshelving.in.net/dc06681a3f4e" or domainname like "sdx.unguidedfreewill.co" or url like "sdx.unguidedfreewill.co" or siteurl like "sdx.unguidedfreewill.co" or domainname like "kffd3.vogueatelier.cc" or url like "kffd3.vogueatelier.cc" or siteurl like "kffd3.vogueatelier.cc" or domainname like "sp13.gstats-api-cont.co" or url like "sp13.gstats-api-cont.co" or siteurl like "sp13.gstats-api-cont.co" or domainname like "metrics.demobunfiber.top" or url like "metrics.demobunfiber.top" or siteurl like "metrics.demobunfiber.top" or domainname like "wdx.velqo7.co" or url like "wdx.velqo7.co" or siteurl like "wdx.velqo7.co" or domainname like "xn--b1aluem3j.gstats-api-contd.cc" or url like "xn--b1aluem3j.gstats-api-contd.cc" or siteurl like "xn--b1aluem3j.gstats-api-contd.cc" or domainname like "xn--b1ahgbfifq.gstats-api-cont.co" or url like "xn--b1ahgbfifq.gstats-api-cont.co" or siteurl like "xn--b1ahgbfifq.gstats-api-cont.co" or domainname like "kr.cedar2glanz.ru" or url like "kr.cedar2glanz.ru" or siteurl like "kr.cedar2glanz.ru" or domainname like "fd-api-irs.velqo7.co" or url like "fd-api-irs.velqo7.co" or siteurl like "fd-api-irs.velqo7.co" or domainname like "lb.propertyfind.cc" or url like "lb.propertyfind.cc" or siteurl like "lb.propertyfind.cc" or domainname like "jup.unguidedfreewill.co" or url like "jup.unguidedfreewill.co" or siteurl like "jup.unguidedfreewill.co" or domainname like "fr.hugo-mapp.co" or url like "fr.hugo-mapp.co" or siteurl like "fr.hugo-mapp.co" or domainname like "sp1.gstats-api-coni.co" or url like "sp1.gstats-api-coni.co" or siteurl like "sp1.gstats-api-coni.co" or domainname like "fd-api-iris.velqo7.co" or url like "fd-api-iris.velqo7.co" or siteurl like "fd-api-iris.velqo7.co" or domainname like "fgp.unguidedfreewill.co" or url like "fgp.unguidedfreewill.co" or siteurl like "fgp.unguidedfreewill.co" or domainname like "fd-api-irc.velqo7.co" or url like "fd-api-irc.velqo7.co" or siteurl like "fd-api-irc.velqo7.co" or domainname like "geo.estimator-undermostshelving.in.net" or url like "geo.estimator-undermostshelving.in.net" or siteurl like "geo.estimator-undermostshelving.in.net" or domainname like "phys.stunned-amniotic.com" or url like "phys.stunned-amniotic.com" or siteurl like "phys.stunned-amniotic.com" or domainname like "sp13.gstats-api-coni.co" or url like "sp13.gstats-api-coni.co" or siteurl like "sp13.gstats-api-coni.co" or domainname like "dau.hugo-mapp.co" or url like "dau.hugo-mapp.co" or siteurl like "dau.hugo-mapp.co" or domainname like "paf.hugo-mapp.co" or url like "paf.hugo-mapp.co" or siteurl like "paf.hugo-mapp.co" or domainname like "fd.gstats-api-contact.cc" or url like "fd.gstats-api-contact.cc" or siteurl like "fd.gstats-api-contact.cc" or domainname like "https://kr.cedar2glanz.ru/jewel.js" or url like "https://kr.cedar2glanz.ru/jewel.js" or siteurl like "https://kr.cedar2glanz.ru/jewel.js" or domainname like "fd-api-rop.velqo7.co" or url like "fd-api-rop.velqo7.co" or siteurl like "fd-api-rop.velqo7.co" or domainname like "riyazinikokar.xyz" or url like "riyazinikokar.xyz" or siteurl like "riyazinikokar.xyz" or domainname like "mgo.gstats-api-contact.cc" or url like "mgo.gstats-api-contact.cc" or siteurl like "mgo.gstats-api-contact.cc" or domainname like "pf.hugo-mapp.co" or url like "pf.hugo-mapp.co" or siteurl like "pf.hugo-mapp.co"

Detection Query 2 :

dstipaddress IN ("45.150.34.2","150.241.94.112","212.118.56.166","145.249.109.147") or srcipaddress IN ("45.150.34.2","150.241.94.112","212.118.56.166","145.249.109.147")

Detection Query 3 :

sha256hash IN ("c2256961d9b7704e2bb85ae9512b4c1ee75fea95532434230c93cd5e38ef8aa7","15fea063a3ceba5e929536357d1e9e1b9f0326fcbec50d570c4583712b109d6f","38e74ff8d5f02617ff8858d9094b455d4e999223c7f78726584690e7201d94b7","10f411e530c7bd86583ce80977d795837d85bab6b3ecb01fe3f3d069cdaeca8e","87e8d39db624f37d3e77aedf487a2dfd197f71a4730ea74f4e7a4341deaec2ff","7504898b17a9ce05eb9209128bcd0fb67d675a70c8c64f6f624d08b47b2fe3af","279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92","9aa88b8e5b298e78ebd55ad53d322efe4b26e6cb1fadf6e94ae258d62a3362e4","abd28aecb2d57660bcd9455333b84d289aa883eaf5cf15def1bf0feb35833aa2","86fbce191248bcc124b1259a178d84216d713f4acd516f578c5f3fdccb01fa4a","93830d73ddf9665ae4d5665f1cebabd093646ed54356662e1b2a925bc2df681b","88735b838a83428193d1909424d082339cc1a993a4f91a9df09f51c81c69f70a","9f7b6aa8bd4c726a9a8d4c2788814db417a21cf4a7f9de3e1fc2bca6203a4e14","643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205","0d660045808528c0525313b148f649eb77a341a2a2f8c5641721551362aa73d0","1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25","bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b","be028ac6299ce6c2870941c700fa1fb2581bfd4ee6c0c75e89c5da9cea73fe97","20040a8d6389a1a638c39b5457f235b2c23efa8bbd9f98204db831d5e3dc9b66","91c4e9537558ef4481e5ea29c785fd1bc3f162bb60e2fa313239957e4381cacf","0c9bb4ced6c55776b0b2b903b4f65f2653d5868214601a4dcceea27789701dd5","264c87880f7afaeb02e0fa522db52294d5a4198ae97fcf67d9aace3474c1b62f")