Категории

MALWARE on a BLOCKCHAIN! | Malware Analysis of ClearFake hosed on hacked WordPress sites

Опубликовано: 11 Апрель 2026
на канале: Jai Minton - CyberRaiju
1,371
76

Analysis of ClearFake malware which is planted on compromised WordPress websites to convince unsuspecting visitors to download and run malware.

** Find me at **
Twitter/X -   / cyberraiju  
Blog - https://www.jaiminton.com/
Mastodon - https://infosec.exchange/@CyberRaiju

** Tools **
FLARE VM - https://github.com/mandiant/flare-vm
Detect-It-Easy - https://github.com/horsicq/Detect-It-...
Deobfuscate for Obfuscator.io - https://obf-io.deobfuscate.io/
Publicwww - https://publicwww.com/
Urlscan - https://urlscan.io/
Rapid7 IDAT Loader Extractor - https://github.com/rapid7/Rapid7-Labs...
Yara - https://github.com/VirusTotal/yara/re...
Yara Rule - https://github.com/JPMinty/Detection_...
FLOSS - https://github.com/mandiant/flare-floss
pestudio - https://www.winitor.com/download

** Sample **
https://bazaar.abuse.ch/sample/ad6a8f...
https://bazaar.abuse.ch/sample/384d11...

* IDAT Loader Analysis*
Part 1 -    • This ANTIVIRUS runs MALWARE | Malware Anal...  
Part 2 -    • MALWARE ANALYSIS | Reversing IDAT (Hijack)...  

** Website Scans **
https://urlscan.io/search/#bsc-datase...
https://urlscan.io/result/269a495e-be...
https://urlscan.io/result/42c40952-f9...

** Further Reading **
https://rmceoin.github.io/malware-ana...
https://blog.sekoia.io/clearfake-a-ne...
https://www.rapid7.com/blog/post/2023...
https://bscscan[.]com/address/0x34585777843Abb908a1C5FbD6F3f620bC56874AA
https://docs.soliditylang.org/en/v0.4...
https://en.wikipedia.org/wiki/Smart_c...

** Timestamps **
00:00 - Intro
00:14 - ClearFake Summary
00:45 - Sekoia Blog Post
01:12 - ClearFake Attack Chain
01:50 - Smart Contract Analysis
02:56 - Interacting with a Smart Contract
04:25 - Analysing Smart Contract Response
05:30 - Domain Pivot via Urlscan.io
06:30 - Analysing Potentially Compromised Websites
07:52 - Analysing ClearFake Phishing Page
09:00 - Multi-language Phishing Support
10:00 - Payload in HTML Content
10:38 - Another Compromised Website
11:38 - Analysis of BLUE.ps1
13:28 - Base64 PowerShell Script Analysis
14:20 - AES Decryption in CyberChef
17:20 - Final Downloader Analysis
18:23 - Final Malware Analysis
21:05 - Hunting for IDAT Loader
22:24 - Extracting Final Payload
22:55 - Identifying Malware Loaded by ClearFake
24:32 - Summary
25:07 - Outro

Credits:
SFX by Pixabay

play_arrow
491
5

Toyota Corolla. TV Commercial.

Toyota Corolla. TV Commercial.
play_arrow
1,885
126

сессия на худграфе / влог из института

сессия на худграфе / влог из института
play_arrow
2,081
117

Аниме клип - Teeth ^ Бродячих псов

Аниме клип - Teeth ^ Бродячих псов
play_arrow
3,411
107

NOLAV ft. AYDEE - SHAWTY (Official 4K Video)

NOLAV ft. AYDEE - SHAWTY (Official 4K Video)
play_arrow
139
12

КАК ЗАРАБОТАТЬ ИГРАЯ В CS:GO?

КАК ЗАРАБОТАТЬ ИГРАЯ В CS:GO?
play_arrow
697
12

Chaturbate escoge a su modelo del año en los Premios Bantokens

Chaturbate escoge a su modelo del año en los Premios Bantokens
play_arrow
1,884
43

ХУДЫЕ ПРОТИВ ТОЛСТЫХ| Super World Box

ХУДЫЕ ПРОТИВ ТОЛСТЫХ| Super World Box
play_arrow
108
4

Vlog. Абрау-Дюрсо. Поющие водопады

Vlog. Абрау-Дюрсо. Поющие водопады
Похожие видео
play_arrow
MALWARE on a BLOCKCHAIN! | Malware Analysis of ClearFake hosed on hacked WordPress sites

MALWARE on a BLOCKCHAIN! | Malware Analysis of ClearFake hosed on hacked WordPress sites
play_arrow
MALWARE on GitHub | `Cracked Software` Reverse Engineering via Debugging, FLOSS, and API monitoring

MALWARE on GitHub | `Cracked Software` Reverse Engineering via Debugging, FLOSS, and API monitoring
play_arrow
MALWARE on WordPress site | LNK file MALWARE ANALYSIS and HTA Deobfuscation

MALWARE on WordPress site | LNK file MALWARE ANALYSIS and HTA Deobfuscation
play_arrow
Homebrew MacOS MALWARE! | Decrypting Cuckoo Stealer using Python

Homebrew MacOS MALWARE! | Decrypting Cuckoo Stealer using Python
play_arrow
Backdoored WASABI WALLET | Reverse Engineering a malicious MSI and Java Archive Malware Downloader

Backdoored WASABI WALLET | Reverse Engineering a malicious MSI and Java Archive Malware Downloader
play_arrow
Malware Analysis | AsyncRAT Injector | AES Decryption with CyberChef, and ISO File Forensics

Malware Analysis | AsyncRAT Injector | AES Decryption with CyberChef, and ISO File Forensics
play_arrow
MALWARE ANALYSIS | Reversing IDAT (Hijack) Loader / Injector using x32dbg, Ghidra, and IDA

MALWARE ANALYSIS | Reversing IDAT (Hijack) Loader / Injector using x32dbg, Ghidra, and IDA
play_arrow
This ANTIVIRUS runs MALWARE | Malware Analysis Lab (IDAT Loader Part 1)

This ANTIVIRUS runs MALWARE | Malware Analysis Lab (IDAT Loader Part 1)
play_arrow
Stealthy MSIX MALWARE | Malware Analysis (FakeBat)

Stealthy MSIX MALWARE | Malware Analysis (FakeBat)
play_arrow
UNDETECTED Discord MALWARE | Reverse Engineering Duvet Stealer, Electron Malware Used By HACKERS

UNDETECTED Discord MALWARE | Reverse Engineering Duvet Stealer, Electron Malware Used By HACKERS
play_arrow
Malware in a PICTURE! | Reverse Engineering an XWorm Loader that uses STEGANOGRAPHY

Malware in a PICTURE! | Reverse Engineering an XWorm Loader that uses STEGANOGRAPHY
play_arrow
Create YARA rules with GHIDRA | MALWARE Analysis of Havoc Demon implants

Create YARA rules with GHIDRA | MALWARE Analysis of Havoc Demon implants
play_arrow
.NET Malware Analysis | Reversing the Dark Tortilla Crypter

.NET Malware Analysis | Reversing the Dark Tortilla Crypter
play_arrow
SVCHOST MALWARE recruits you into a botnet | BlackNET RAT deep dive malware analysis

SVCHOST MALWARE recruits you into a botnet | BlackNET RAT deep dive malware analysis
play_arrow
Single Player Game Hacking 101 | Becoming a BILLIONAIRE by manipulating FFVII memory and save games

Single Player Game Hacking 101 | Becoming a BILLIONAIRE by manipulating FFVII memory and save games
play_arrow
Static and Dynamic MALWARE ANALYSIS | Agent Tesla from an AutoIT EXE

Static and Dynamic MALWARE ANALYSIS | Agent Tesla from an AutoIT EXE
play_arrow
Bypassing a DUMB, Endpoint Detection and Response (EDR) Tool

Bypassing a DUMB, Endpoint Detection and Response (EDR) Tool
play_arrow
SECRETS of Scheduled Tasks | How TARRASK MALWARE hides Scheduled Tasks from security teams

SECRETS of Scheduled Tasks | How TARRASK MALWARE hides Scheduled Tasks from security teams
play_arrow
PowerShell MALWARE that STEALS my clipboard | Webhook Clipper Malware Analysis

PowerShell MALWARE that STEALS my clipboard | Webhook Clipper Malware Analysis
play_arrow
FIX corrupted archives with 010 Templates

FIX corrupted archives with 010 Templates
play_arrow
Android Malware steals PRIVATE browsing history! | Reverse Engineering ANDROID MALWARE

Android Malware steals PRIVATE browsing history! | Reverse Engineering ANDROID MALWARE
play_arrow
Malware Analysis of .NET Information Stealers | Snake Keylogger

Malware Analysis of .NET Information Stealers | Snake Keylogger
play_arrow
This is the most popular HACKING TOOL! | Cobalt Strike Stager Malware Analysis

This is the most popular HACKING TOOL! | Cobalt Strike Stager Malware Analysis
play_arrow
Fortnite hackers, GET HACKED? Redline Stealer MALWARE ANALYSIS

Fortnite hackers, GET HACKED? Redline Stealer MALWARE ANALYSIS