ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://plugin-dex.cc/svvv2.ps1.

Database Entry

IOC ID:	2018193
IOC:	https://plugin-dex.cc/svvv2.ps1
IOC Type :	url
Threat Type :	payload_delivery
Malware:	Unknown Loader
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
ASN:	AS13335 CLOUDFLARENET
Country:	US
First seen:	2026-11-06 19:08:29 UTC
Last seen:	never
UUID:	8dfc0a5d-da0c-11f1-a74e-42010aa4000a
Reporter	fbazs
Reward	5 credits from ThreatFox
Tags:	ClickFix hhunter PluginDex powershell
Reference:	https://web.archive.org/web/20261106172412/https://plugin-dex.cc/svvv2.ps1

fbazs

ClickFix PowerShell stager served by the fake plugin catalogue PluginDex (plugin-dex.cc), archived by the Wayback Machine on 2026-11-06 17:24 UTC (HTTP 200, text/plain, SHA1 18cb16009c7287e6f5691f27e5e72dac6cf919f1 gzip body). Also declared in the public site repo (deploy/nginx/plugin-dex.cc.conf, location /svvv2.ps1). Downloads https://93.152.209.8:9445/clickfix/AYN9iXh1hl/file with curl.exe -k to %APPDATA%\s2\svvv2.zip, extracts it with tar.exe, runs the first .msi silently through WMI Win32_Process.Create (msiexec /i /qn /norestart), then deletes HKCU RunMRU to erase the Win+R trace.