← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
ClickFix Gets Creative: Malware Buried in Images | Huntress
WHITE CyberHunter_NL 2025-11-28 Modified: 2025-12-28
47
IOCs
MEDIUM VOLUME
Find out more about the Huntress products and services on the Microsoft Marketplace and on our site for free and unlimited access to all the latest technology and resources. and information on how to use them.
windows updateclickfix lurehuntresspowershellwindows runredactedblob urlclickfix domainlummac2clickfixrhadamanthysfindpythonshellcodeclusterupdate lureqilinnexus threat
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Update Lure Windows Update Qilin Nexus Threat Rhadamanthys Huntress
Indicators of Compromise (47)
All FileHash-MD5 URL domain hostname
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 cd8302542f494f4d8fbcb2d21425b316 — 2025-11-28
URL http://141.98.80.175/ercx.dat — 2025-11-28
URL http://141.98.80.175/gpsc.dat — 2025-11-28
URL http://141.98.80.175/rtdx.dat — 2025-11-28
URL http://141.98.80.175/tick.odd — 2025-11-28
URL http://141.98.80.175/very.dat — 2025-11-28
URL http://81.90.29.64/ebc/rps.gz — 2025-11-28
URL http://94.74.164.136/fifx.odd — 2025-11-28
URL http://bendavo.su/asdsa — 2025-11-28
URL http://conxmsw.su/vcsf — 2025-11-28
URL http://corezea.com/ebc — 2025-11-28
URL http://exposqw.su/casc — 2025-11-28
URL http://narroxp.su/rewd — 2025-11-28
URL http://ozonelf.su/asd — 2025-11-28
URL http://squatje.su/asdasd — 2025-11-28
URL http://squeaue.su/qwe — 2025-11-28
URL http://vicareu.su/bcdf — 2025-11-28
domain bendavo.su — 2025-11-28
domain cmevents.live — 2025-11-28
domain cmevents.pro — 2025-11-28
domain conxmsw.su — 2025-11-28
domain corezea.com — 2025-11-28
domain cosmicpharma-bd.com — 2025-11-28
domain exposqw.su — 2025-11-28
domain galaxyswapper.pro — 2025-11-28
domain groupewadesecurity.com — 2025-11-28
domain hypudyk.shop — 2025-11-28
domain narroxp.su — 2025-11-28
domain ozonelf.su — 2025-11-28
domain securitysettings.live — 2025-11-28
domain sportsstories.gr — 2025-11-28
domain squatje.su — 2025-11-28
domain squeaue.su — 2025-11-28
domain vicareu.su — 2025-11-28
domain virhtechgmbh.com — 2025-11-28
domain xcvcxoipoeww.site — 2025-11-28
domain xmcniiadpwqw.site — 2025-11-28
domain xoiiasdpsdoasdpojas.com — 2025-11-28
domain xpoalswwkjddsljsy.com — 2025-11-28
URL http://f6b04000.consent-verify.pages.dev/ — 2025-11-28
hostname 1e442295.consent-verify.pages.dev — 2025-11-28
hostname 3b4ce6c9.consent-verify.pages.dev — 2025-11-28
hostname 3e6eb645.consent-verify.pages.dev — 2025-11-28
hostname 5df43170.consent-verify.pages.dev — 2025-11-28
hostname 6b04000.consent-verify.pages.dev — 2025-11-28
hostname d9e71335.consent-verify.pages.dev — 2025-11-28
hostname f6b04000.consent-verify.pages.dev — 2025-11-28
References (1)
↗ https://www.huntress.com/blog/clickfix-malware-buried-in-images