MB-7c5584457f8a6993b311b06ef0bc2c7985335289d0ad52a158f3717e7e134d36
high
📛 Threat Title
Unknown: aidvertiser.applescript
Description
File type: unknown. Size: 1606 bytes. Tags: aidvertiser, applescript, clickfix. Reporter: mauroeldritch. First seen: 2026-05-14 21:04:17.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
aidvertiser.applescript
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/aidvertiser.applescript
IOC database
- Type
- domain
- Value
aidvertiser.applescript- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat MB-7c5584457f8a6993b311b06ef0bc2c7985335289d0ad52a158f3717e7e134d36
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/aidvertiser.applescript
hash_sha256
7c5584457f8a6993b311b06ef0bc2c7985335289d0ad52a158f3717e7e134d36
IOC database
- Type
- hash_sha256
- Value
7c5584457f8a6993b311b06ef0bc2c7985335289d0ad52a158f3717e7e134d36- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
f946cbed6cde4d24009f1f6a4c0375a0
IOC database
- Type
- hash_md5
- Value
f946cbed6cde4d24009f1f6a4c0375a0- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: unknown. Size: 1606 bytes. Tags: aidvertiser, applescript, clickfix. Reporter: mauroeldritch. First seen: 2026-05-14 21:04:17.
Remediations (10)
-
web:access.redhat.com
Remediation Timeline Given the interest in how this vulnerability was disclosed and remediated, the following timeline outlines the key events. 2026-03-23 Reporter privately contacts upstream 2026-03-24 Upstream acknowledges receiving the report 2026-03-25 Upstream/Reporter propose and review patches 2026-04-01 Upstream commits patch to ...
-
web:community.spiceworks.com
This is for the remediation status column. I can't find anything on the interwebs about this. I know the scripts should work b/c I used other scripts that worked and only changed the registry key and value within each script, and the scripts are UTF-8. Detection status of course shows 'With issues' b/c the registry key value is wrong, the remediation script sets to correct value. DETECT ...
-
web:github.com
The Intune Remediations collection is a set of script packages designed to detect and fix common support issues on user endpoints. Each script package includes a detection script, a remediation script, and metadata. By deploying these packages through Intune, you can proactively address issues before end-users even notice them, potentially reducing support calls.
-
web:learn.microsoft.com
Learn more about Remediations in Microsoft Intune, including what Remediations are and view any prerequisites and licensing requirements. Also, learn how to deploy built-in and custom remediation scripts, and learn how to monitor your scripts.
-
web:stackoverflow.com
I create a detection and remediation script and upload it in Intune however when I run the remediation script the status shows in the detection (With issues) and remediation (failed).
-
web:stackoverflow.com
Failed remediation script in Intune while "run script 64-bit PowerShell" option is turned on Ask Question Asked 1 year, 10 months ago Modified 1 year, 10 months ago
-
web:techcommunity.microsoft.com
Device Remediation status misleading Maybe I'm just missing something here, but when a Remediation script repeats on a schedule, how can we tell if devices were remediated? All devices report "Without Issues" and ZERO devices fixed, but I know the script ran and fixed the problem weeks ago. Say I have 100 devices assigned to the script:
-
web:www.reddit.com
Here is the remediation script we're running as of now: Shouldn't Exit code = 0 return a success status? ... I am planning to set up a handful of additional proactive remediations so I am using this scenario to get a better understand of how it works. Thanks in advance for any insights.
-
web:www.reddit.com
I created a Proactive Remediation to uninstall software with silent switches and it fails out. In the AgentExecutor.log I see "Powershell script is failed to execute".
-
web:www.reddit.com
Anyone else have issues running on-demand proactive remediations ? I think I have seen it kick off a couple times, but then after that nothing. It's…
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.