Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
19 IOCs
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
Threat Actors
Malware Families
Excerpt
Elastic Security Labs is tracking an emerging threat named TELEPUZ, which we have discovered spreading widely via a CLICKFIX-VIDAR chain. This malware is in active development and has been operating since late April 2026, according to the infrastructure information we collected. The malware is full-featured, lightweight, and modular. While the number of C2 domains is currently small, the daily volume of builds uploaded to VirusTotal and the rapid pace of updates indicate…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →19 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | wblob.forum | High | Score 58/100 | First seen |
| Domain | codebasecode.com | Low | Score 32/100 | First seen |
| SHA256 | 580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c954 | High | Score 85/100 | First seen |
| SHA256 | 58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed | Medium | Score 67/100 | First seen |
| Domain | cal.snehamumbai.org | High | Score 86/100 | First seen |
| SHA256 | bf3b4e645a3c0c23f87c55971069014f7424ad14497371ee7567eff68ffaf343 | Medium | Score 53/100 | First seen |
| Domain | cal.joycedoula.com.br | High | Score 74/100 | First seen |
| SHA256 | 444f1c0c82b3f6cc31d685bac68b20edbde5722ce219af9cceab0c2a6537efc1 | Low | Score 33/100 | First seen |
| SHA256 | 03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746 | Medium | Score 53/100 | First seen |
| SHA256 | ff791fe1532a2dc3b3c188a71bfd0177f973ef228e4d1dda1db6d3c4b0d62b3e | Medium | Score 53/100 | First seen |
| URL | https://172.67.215.214/files/telemetriawork/telepuz.dll | Low | Score 28/100 | First seen |
| URL | https://steamcommunity.com//profiles/76561199705801219 | High | Score 58/100 | First seen |
| SHA256 | d0bba09f1bf9253816511731dd376e1cbbc8437c6225fda8b04c0bf1787236b9 | Medium | Score 53/100 | First seen |
| URL | https://memshowblob.forum/api/index.php?a=grab | High | Score 58/100 | First seen |
| SHA256 | 9733a3f6409de81271f21993c7f8b9865ac9f5c68c3d4336e91afe6b312477eb | Low | Score 33/100 | First seen |
| SHA256 | a955d7e2819d5fa8b5f879cb970e1a1a91327098a7383f2a03a5e1e7e19435e3 | Low | Score 33/100 | First seen |
| SHA256 | cee96a38e2dfe31ccf8c3aa7d0d9323e1e3183b2478ba582285822e943d242e9 | Medium | Score 53/100 | First seen |
| Domain | hurgadatour.shop | High | Score 81/100 | First seen |
| URL | https://172.67.165.144/files/telemetriawork/telepuz.dll | Low | Score 29/100 | First seen |
IOC Relationship Graph
Building graph…