#Clickfix initial payloads at:
https:// github. com/snowplow-byte/
#stealer still unknown sadly
exe hash: 70bf0a8c0ffe5d1aa51358aba0ae365a1fab15cc356a02c07a36de6427e3ca7f
@james_inthe_box@infosec.exchange @Ffforward@infosec.exchange
🔥 stream.echovale[.]cc
🔥 104.21.6.184:443 (Cloudflare ASN 13335)
🔥 172.67.155.44:443 (Cloudflare ASN 13335)
0
Ultimately I believe these are #amatera #stealer https://gendigital.com/blog/insights/research/wordlistloader-delivering-amatera-via-clearfake-campaigns thanks to @Ffforward@infosec.exchange