{
  "type": "SHA1",
  "indicator": "b374d1715148bc80394b844d9f008adfa5585d65",
  "general": {
    "sections": [
      "general",
      "analysis"
    ],
    "type": "sha1",
    "type_title": "FileHash-SHA1",
    "indicator": "b374d1715148bc80394b844d9f008adfa5585d65",
    "validation": [],
    "base_indicator": {
      "id": 4333978437,
      "indicator": "fa1f2ac9172702ad10c24f0a637c26cd",
      "type": "FileHash-MD5",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69f1de85544538ce8b03332a",
          "name": "User interaction with a ClickFix-style phishing site resulted in execution of an obfuscated PowerShell command",
          "description": "A ClickFix-style phishing campaign leveraged social engineering to trick users into executing obfuscated PowerShell commands that downloaded and installed a malicious MSI payload from a remote server. The attack employed a sophisticated multi-stage infection chain utilizing DLL sideloading techniques with renamed legitimate binaries to execute malicious components. The final payload deployed HijackLoader to deliver a Lumma-style information stealer designed for credential harvesting and data exfiltration. The campaign utilized multiple command-and-control domains and infrastructure hosted on specific IP addresses. Mitigation measures include blocking identified artifacts, enhancing user awareness about ClickFix social engineering tactics, implementing endpoint detection for suspicious PowerShell activity and unsigned DLL sideloading, and isolating compromised systems for remediation.",
          "modified": "2026-05-29T10:27:04.797000",
          "created": "2026-04-29T10:33:41.967000",
          "tags": [
            "phishing",
            "lumma stealer",
            "powershell",
            "information stealer",
            "credential theft",
            "hijackloader",
            "dll sideloading",
            "lummastealer",
            "clickfix"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "HijackLoader",
              "display_name": "HijackLoader",
              "target": null
            },
            {
              "id": "Lumma Stealer - S1213",
              "display_name": "Lumma Stealer - S1213",
              "target": null
            },
            {
              "id": "LummaStealer",
              "display_name": "LummaStealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1574.002",
              "name": "DLL Side-Loading",
              "display_name": "T1574.002 - DLL Side-Loading"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 3,
            "URL": 2,
            "domain": 1
          },
          "indicator_count": 12,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386446,
          "modified_text": "1 day ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-SHA256",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f32d843b6570c22f6059eb",
          "name": "EbeeApril2026 Pt8",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-05-30T10:03:42.474000",
          "created": "2026-04-30T10:23:00.416000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "yara",
            "filepath",
            "cve20221388 url",
            "cve20151770 cve",
            "client"
          ],
          "references": [
            "IOCs.2026.csv"
          ],
          "public": 1,
          "adversary": "Trigona, SHub Stealer v2.0, Malicious Compiled HTML Help File, Vidar",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 95,
            "FileHash-MD5": 163,
            "FileHash-SHA1": 147,
            "FileHash-SHA256": 290,
            "CIDR": 1,
            "CVE": 12,
            "SSLCertFingerprint": 1,
            "domain": 90,
            "email": 2,
            "hostname": 116
          },
          "indicator_count": 917,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "9 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-SHA256",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f2df5e140f409ab916970d",
          "name": "User interaction with a ClickFix-style phishing site resulted in execution of an obfuscated PowerShell command",
          "description": "",
          "modified": "2026-05-29T10:27:04.797000",
          "created": "2026-04-30T04:49:34.790000",
          "tags": [
            "phishing",
            "lumma stealer",
            "powershell",
            "information stealer",
            "credential theft",
            "hijackloader",
            "dll sideloading",
            "lummastealer",
            "clickfix"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "HijackLoader",
              "display_name": "HijackLoader",
              "target": null
            },
            {
              "id": "Lumma Stealer - S1213",
              "display_name": "Lumma Stealer - S1213",
              "target": null
            },
            {
              "id": "LummaStealer",
              "display_name": "LummaStealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1574.002",
              "name": "DLL Side-Loading",
              "display_name": "T1574.002 - DLL Side-Loading"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69f1de85544538ce8b03332a",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 3,
            "URL": 2,
            "domain": 1
          },
          "indicator_count": 12,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 278,
          "modified_text": "1 day ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "FileHash-SHA256",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IOCs.2026.csv"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [
            "Lumma stealer - s1213",
            "Lummastealer",
            "Hijackloader"
          ],
          "industries": []
        },
        "other": {
          "adversary": [
            "Trigona, SHub Stealer v2.0, Malicious Compiled HTML Help File, Vidar"
          ],
          "malware_families": [
            "Lumma stealer - s1213",
            "Lummastealer",
            "Hijackloader"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69f1de85544538ce8b03332a",
      "name": "User interaction with a ClickFix-style phishing site resulted in execution of an obfuscated PowerShell command",
      "description": "A ClickFix-style phishing campaign leveraged social engineering to trick users into executing obfuscated PowerShell commands that downloaded and installed a malicious MSI payload from a remote server. The attack employed a sophisticated multi-stage infection chain utilizing DLL sideloading techniques with renamed legitimate binaries to execute malicious components. The final payload deployed HijackLoader to deliver a Lumma-style information stealer designed for credential harvesting and data exfiltration. The campaign utilized multiple command-and-control domains and infrastructure hosted on specific IP addresses. Mitigation measures include blocking identified artifacts, enhancing user awareness about ClickFix social engineering tactics, implementing endpoint detection for suspicious PowerShell activity and unsigned DLL sideloading, and isolating compromised systems for remediation.",
      "modified": "2026-05-29T10:27:04.797000",
      "created": "2026-04-29T10:33:41.967000",
      "tags": [
        "phishing",
        "lumma stealer",
        "powershell",
        "information stealer",
        "credential theft",
        "hijackloader",
        "dll sideloading",
        "lummastealer",
        "clickfix"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "HijackLoader",
          "display_name": "HijackLoader",
          "target": null
        },
        {
          "id": "Lumma Stealer - S1213",
          "display_name": "Lumma Stealer - S1213",
          "target": null
        },
        {
          "id": "LummaStealer",
          "display_name": "LummaStealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1574.002",
          "name": "DLL Side-Loading",
          "display_name": "T1574.002 - DLL Side-Loading"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 3,
        "URL": 2,
        "domain": 1
      },
      "indicator_count": 12,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386446,
      "modified_text": "1 day ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-SHA256",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f32d843b6570c22f6059eb",
      "name": "EbeeApril2026 Pt8",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-05-30T10:03:42.474000",
      "created": "2026-04-30T10:23:00.416000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "yara",
        "filepath",
        "cve20221388 url",
        "cve20151770 cve",
        "client"
      ],
      "references": [
        "IOCs.2026.csv"
      ],
      "public": 1,
      "adversary": "Trigona, SHub Stealer v2.0, Malicious Compiled HTML Help File, Vidar",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 95,
        "FileHash-MD5": 163,
        "FileHash-SHA1": 147,
        "FileHash-SHA256": 290,
        "CIDR": 1,
        "CVE": 12,
        "SSLCertFingerprint": 1,
        "domain": 90,
        "email": 2,
        "hostname": 116
      },
      "indicator_count": 917,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 40,
      "modified_text": "9 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-SHA256",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f2df5e140f409ab916970d",
      "name": "User interaction with a ClickFix-style phishing site resulted in execution of an obfuscated PowerShell command",
      "description": "",
      "modified": "2026-05-29T10:27:04.797000",
      "created": "2026-04-30T04:49:34.790000",
      "tags": [
        "phishing",
        "lumma stealer",
        "powershell",
        "information stealer",
        "credential theft",
        "hijackloader",
        "dll sideloading",
        "lummastealer",
        "clickfix"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "HijackLoader",
          "display_name": "HijackLoader",
          "target": null
        },
        {
          "id": "Lumma Stealer - S1213",
          "display_name": "Lumma Stealer - S1213",
          "target": null
        },
        {
          "id": "LummaStealer",
          "display_name": "LummaStealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1574.002",
          "name": "DLL Side-Loading",
          "display_name": "T1574.002 - DLL Side-Loading"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69f1de85544538ce8b03332a",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Tr1sa111",
        "id": "192483",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 3,
        "URL": 2,
        "domain": 1
      },
      "indicator_count": 12,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 278,
      "modified_text": "1 day ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "FileHash-SHA256",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "b374d1715148bc80394b844d9f008adfa5585d65",
    "type": "Hash"
  },
  "abuseipdb": null,
  "urlhaus": null,
  "from_cache": true,
  "_cached_at": 1780173764.8404272
}