s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932679 high

📛 Threat Title

ClearFake: SHA256 hash of a malware sample (payload) 9e319c06b30efd0abeba0af23cdffa6dd7f6b288d2c625ead7a46aac92c4085d

Category: ClearFake Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: ClearFake. Confidence: 90. First seen: 2026-09-25 05:12:20 UTC. Reporter: anonymous. Tags: ClearFake, ClickFix, ErrTraffic, etherhiding.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 9e319c06b30efd0abeba0af23cdffa6dd7f6b288d2c625ead7a46aac92c4085d

IOC database

Type
hash_sha256
Value
9e319c06b30efd0abeba0af23cdffa6dd7f6b288d2c625ead7a46aac92c4085d
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
SHA256 hash of a malware sample (payload) attributed to ClearFake

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: ClearFake. Confidence: 90. First seen: 2026-09-25 05:12:20 UTC. Reporter: anonymous. Tags: ClearFake, ClickFix, ErrTraffic, etherhiding.

Remediations (10)

  • MalwareBazaar | Browse malware samples - abuse.ch
    web:bazaar.abuse.ch

    Using the form below, you can search for malware samples by a hash (MD5, SHA256 , SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database

  • MalwareBazaar | ClearFake - abuse.ch
    web:bazaar.abuse.ch

    Malware samples associated with tag ClearFake MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with ClearFake . Database Entry

  • ClearFake — Malware Profile & Detection | BotEraser
    web:boteraser.com

    Known SHA256 hashes associated with ClearFake droppers include e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example) and mutex names such as GlobalClearFake_Mutex have been reported in public IOC lists.

  • Hash Reputation Checker — MD5/SHA-256 Malware Lookup
    web:cipherssecurity.com

    Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.

  • Hash Checker - File & Malware Hash Lookup | InventiveHQ
    web:inventivehq.com

    Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.

  • Malware Hashes - File Hash Intelligence | isMalicious
    web:ismalicious.com

    Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.

  • ClearFake Campaign - Delivering Malware via "Fake Browser Updates
    web:www.bridewell.com

    ClearFake is a relatively new, malicious JavaScript framework that was first identified in July 2023 by security researcher Randy McEoin.

  • ClearFake malware — IOCs & CVEs | isMalicious
    web:www.ismalicious.com

    30,881 indicators of compromise attributed to the ClearFake malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • ClearFake - Malware Analysis Lab : Jai Minton
    web:www.jaiminton.com

    Analysis of ClearFake malware which is planted on compromised WordPress websites to convince unsuspecting visitors to download and run malware .

  • ClearFake: A newcomer to the "fake updates" threat landscape
    web:www.sekoia.com

    By linking the "fake updates" lure to the watering hole technique, ClearFake operators target a wide range of users and conduct effective, scalable malware distribution campaigns. From our telemetry and customers' feedback, we observed an increasing number of communications to ClearFake infrastructure at the end of September 2023.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.