Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
Anatomy of a macOS ClickFix Crimekit that Weaponises EtherHiding
Threat Actors
Malware Families
Excerpt
Posted by: Amin Hazim & Badrul Munir A technical teardown of a macOS ClickFix campaign combining AppleScript execution, EtherHiding, a persistent backdoor, AMOS stealer, XMRig cryptomining, and blockchain-based C2 infrastructure. Contents: Introduction The infection chain at a glance Stage 1 - the clipboard command and the Cloudflare Worker The lure the victim sees The clipboard command What is osascript? Peeling the AppleScript layers Character-ID obfuscation Stage 2 -…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(3)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 4542d94e24b6829e262b1c4af8467e11e40f078ce135d0b110054db4b9577cf0 | Medium | Score 53/100 | First seen |
| SHA256 | a46d6adeb5c8e9ab5883ed8005b6ed684e7181148f5fdec7656ae6e51ca6e676 | Medium | Score 53/100 | First seen |
| MD5 | 427e8b573407f6029923cdb4686b5f77 | Medium | Score 53/100 | First seen |
| SHA256 | e9d3dd808fa4218abdcb2a0a38a52d2337662b65a712663f35b8374476e3da65 | Medium | Score 53/100 | First seen |
| SHA256 | f3fb674441b05fab014212ece2528c92a36df6d45b88951e65ed72606fff0c80 | Medium | Score 53/100 | First seen |
| URL | https://67sixcebeh.surf/xmr | High | Score 58/100 | First seen |
| SHA256 | 9a6b91a3cc2867d4d493823f425f1397afac0f52e17acae937560c3f4d73080d | Medium | Score 53/100 | First seen |
| URL | https://67sixcebeh.surf/upload.php | High | Score 58/100 | First seen |
| SHA256 | 903c7483ffa15cc14181a2dec5d8a9ddf703cddde3aa87e596d948342c8a75dc | Medium | Score 53/100 | First seen |
| SHA256 | d0ee324b6390e9d61f9851cd1fa5f3bde4ce05821cd5b4f67ad665dbffe54ad7 | Medium | Score 53/100 | First seen |
| URL | https://25382ea9.trustkey-otcheckv1.pages.dev | High | Score 58/100 | First seen |
| SHA256 | 872172a61e194ba96af2219b446bdb1cf318509c08ee66489aab20c1c59acf3d | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…