Pulse Detail — Threat Intelligence

PULSE NAME

Clipboard to Compromise: PowerShell Script Self-Pwn | Proofpoint US

WHITE Armature_TIP 2025-02-22 Modified: 2025-03-24

IOCs

MEDIUM VOLUME

Find out more about Proofpoint, the world's leading cybersecurity company, at the same time as the company's US headquarters in New York. Â£1.5m ($2.3m)

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1574 T1104 T1119 T1055 T1566 T1115 T1059

MALWARE FAMILIES

Lumma Vidar Matanbuchus DarkGate NetSupport ClearFake TA571

Indicators of Compromise (3 / 28 total)

All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain email hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-MD5	1bc0891045c3a3348ff19b42ef5b063a	MD5 of 9701fec71e5bbec912f69c8ed63ffb6dba21b9cca7e67da5d60a72139c1795d1	2025-02-22
FileHash-MD5	41af2d08aa940c5a3fd1fa9ccd8d2cb4	MD5 of 11909c0262563f29d28312baffb7ff027f113512c5a76bab7c5870f348ff778f	2025-02-22
FileHash-MD5	6d3cf95a1b85a0c469005a7203203a9f	MD5 of 07e0c15adc6fcf6096dd5b0b03c20145171c00afe14100468f18f01876457c80	2025-02-22

References (1)

↗ https://www.proofpoint.com/us/blog/threat-insight/clipboard-compromise-powershell-self-pwn