TF-1932691 high

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: ClearFake. Confidence: 90. First seen: 2026-09-25 06:17:48 UTC. Reporter: anonymous. Tags: ClearFake, ClickFix, ErrTraffic, etherhiding.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: ClearFake. Confidence: 90. First seen: 2026-09-25 06:17:48 UTC. Reporter: anonymous. Tags: ClearFake, ClickFix, ErrTraffic, etherhiding.

• MalwareBazaar | Malware sample exchange
  web:bazaar.abuse.ch

  MalwareBazaar MalwareBazaar is a platform from abuse.ch and Spamhaus, dedicated to sharing malware samples with the infosec community, antivirus vendors, and threat intelligence providers. Upload malware samples and explore the database for valuable intelligence. Set alerts to track newly observed malware , use APIs to seamlessly push or pull signals, and automate bulk queries. With this ...

  2026-09-25 15:08 UTC
• MalwareBazaar | Browse malware samples - abuse.ch
  web:bazaar.abuse.ch

  Using the form below, you can search for malware samples by a hash (MD5, SHA256 , SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database

  2026-09-25 15:08 UTC
• MalwareBazaar | ClearFake - abuse.ch
  web:bazaar.abuse.ch

  Malware samples associated with tag ClearFake MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with ClearFake . Database Entry

  2026-09-25 15:08 UTC
• ClearFake — Malware Profile & Detection | BotEraser
  web:boteraser.com

  Known SHA256 hashes associated with ClearFake droppers include e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example) and mutex names such as GlobalClearFake_Mutex have been reported in public IOC lists.

  2026-09-25 15:08 UTC
• Malware Hashes - File Hash Intelligence | isMalicious
  web:ismalicious.com

  Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.

  2026-09-25 15:08 UTC
• ClearFake (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.

  2026-09-25 15:08 UTC
• ThreatFox | ClearFake
  web:threatfox.abuse.ch

  ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with js. clearfake . You can also get this data through the ThreatFox API. Database Entry

  2026-09-25 15:08 UTC
• ThreatFox ...
  web:threatfox.abuse.ch

  ClearFake IOC: ad7412590dbf371686d2cddde137ad5e4459a153735846cb3d7dee767247864c ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...

  2026-09-25 15:08 UTC
• ClearFake malware — IOCs & CVEs | isMalicious
  web:www.ismalicious.com

  30,881 indicators of compromise attributed to the ClearFake malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  2026-09-25 15:08 UTC
• Malware Hash Lookup - SecTools
  web:www.sectools.io

  Look up file hashes (MD5, SHA-1, SHA-256 ) against malware databases to check if a file is known malicious. Verify downloaded files, investigate suspicious binaries, and check indicators of compromise.

  2026-09-25 15:08 UTC

Only Available for Registered Users. Sign in to view.