Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE29 IOCs

CRPx0 ClickFix Ransomware Analysis

Ransom-ISAC

Published August 27, 2026Original Report

Malware Families

Diamond Model

Adversary

Infrastructure(1)

Capability(3)

Victim

Indicators of Compromise

Indicators of Compromise29

Type	Indicator	Confidence	Score	First Seen
SHA256	dc36944e733c1c70145681551b32ea95e17770a490e83d61ca525807e6d1fc51 exploitfile-hashintel-blog	Medium	53	Oct 9, 26
MD5	55cf090e07a9ecbff062c47ef93fd1be aptespionagefile-hash	Medium	53	Oct 9, 26
SHA256	290d41e7436238066a8aacbd63a805aeeefc00d8798116dc702eccf6df3eae37 file-hashintel-blogmalware	High	85	Aug 4, 26
SHA256	85b79bbc907b8c0eeacc5da5ac35d7387c69faeb2f7822b3e2dca94f80ed0851 file-hashintel-blogloader	Medium	53	Oct 9, 26
MD5	e205d76c2f1d1bf356fddf6a6aa22601 aptespionagefile-hash	Medium	53	Oct 9, 26
SHA256	e3191e13e6ff9a1a85d1dcffc4e7a8bdcc12329f8ecf0ad825f8670b0d12c97a exploitfile-hashintel-blog	Medium	53	Oct 9, 26
SHA256	53983a29efdc724bf6ae68c9e11bb165945571b079a3c85f213c60bdc4bd2af3 exploitfile-hashintel-blog	Medium	53	Oct 9, 26
SHA256	ef431e36a8ac12051af588d800e1d8128d583a9d4c68187709263a13564081cd file-hashintel-blogmalware	High	85	Aug 4, 26
SHA256	3363e3af60b1e25f8cdc70206f1d7b89e28bb72a7dd43f4460f3ee07d7508f80 aptespionagefile-hash	Medium	53	Oct 9, 26
SHA256	8af1afc82c0d578a54cc34d09544a0695ec2b0d5f244bf1f1bb4993ee7614734 file-hashintel-blogmalware	High	85	Aug 4, 26
SHA256	0dc6a5ce14838813e297a83e3c3c0868c7a211ee2da9c9705e5a282e65f089fe file-hashintel-blogmalware	High	85	Aug 4, 26
SHA256	ad1b8bdfb562ede7017003679185c07b6f746778ee7ed179c54e3c35bc0c4ccb file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	spear.cx exfiltrationintel-blogmalware	High	58	Oct 9, 26
MD5	78f2627f3795ea508fecac16227bbff8 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	8e7027367756ed9cee15529fd39c839f3773e0930fe8207b9a8654625128dd60 file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	e6ce4b7c40d38a246c0dcc88c4f005fe28e3b5a8da603116881f7c5356771c70 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	a190c6075a60b528ec4185e5d4d81ac4d039e5d357ab33e2384ae21b02e29ad4 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	a92641523ad121aaf140234a5ee70940b1fee67f12ea9a67c4ebb8fa9fbdcbeb file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	2a92762213ccde7bfac2a0a72f1816f2 aptespionagefile-hash	Medium	53	Oct 9, 26
SHA256	bee987e441c5b1e49eefed56b04adbee72a6fcb4ddde6bcf4d4abb3bfbc4661c file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	55a81d88fff3dc3de0e42724b0a992d4ef382b0e1a82187abf9d635ab89b2bae file-hashintel-blogmalware	High	85	Aug 4, 26
MD5	59d552bb3abeb278f0f9deb5b838bf6e aptespionagefile-hash	Medium	53	Oct 9, 26
MD5	6aeee2fff046a115f1ff8e78c8794ca9 aptespionagefile-hash	Medium	53	Oct 9, 26
SHA256	bac340524549410f51b060f21abb7db30c0c5378edd2e3ac15b526e141417e89 file-hashintel-blogmalware	High	85	Aug 4, 26
SHA256	32d741ce1461d1e310452ef29ec7906326970af07f9139ea9260abb2df6f0ae5 file-hashintel-blogloader	Medium	53	Oct 9, 26
SHA256	9cfe9b894af68946ddc7e6f4cbdb085a92c4009ea00554c407beb5a8fc29f6b7 file-hashintel-blogmalware	High	85	Aug 4, 26
SHA256	7bfc7148c9eb8a3bcc6472e56e7d5be901462873d793323c69067d6dbfa2f79a aptespionagefile-hash	Medium	53	Oct 9, 26
SHA256	28685dff00aa1752b62a8580955b2530d63092bdcc0528b872a668cddad78c11 file-hashintel-blogmalware	High	85	Aug 4, 26
SHA256	2d3dfec60201dcc8d0b08abefa8d43efe5f62c33110f036560baa6f1bf24ea8a aptespionagefile-hash	Medium	53	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph29 total IOCs

SHA256MD5Domain

scroll to zoom · drag to pan · click IOC to open