Eric Parker, a recognized cybersecurity expert, has recently released a video on ClickFix attacks, their detection, analysis, and gathering threat intelligence. Here is our recap highlighting the key points and practical advice.

ClickFix as the Signature Threat of 2025

In 2025 the internet saw a sharp surge in a deceptively simple but highly effective social-engineering technique known as ClickFix: fake CAPTCHA pages tricking victims into running commands or pasting paths that install malware on their devices. What began as isolated malvertising and phishing pages has evolved into cross-platform, professionally produced scam traps and the second most prevalent attack vector globally, trailing only traditional phishing.  
 
ClickFix bypasses automated defenses by turning victims into unwitting accomplices, exploiting human psychology over technical tricks and vulnerabilities. 

The Technique Essence in a Nutshell 

An attacker presents a convincing CAPTCHA / verification / “fix this” UI that instructs the user to copy & paste a short snippet into a system dialog or terminal (for example: Run dialog, File Explorer address bar, or Terminal). JavaScript on the page often silently places an obfuscated command on the clipboard and/or shows an instruction video.  

When the user pastes and hits Enter they execute that command which downloads and runs malware. The chain relies entirely on social engineering and trusted OS interfaces rather than exploit primitives. 
 
ClickFix isn’t limited to Windows. In 2025 campaigns increasingly tailored payloads and instructions for macOS and Linux. Often they abused legitimate distribution/installation flows (for example, spoofing Homebrew install pages or using shell commands) making the technique even more stealthy on non-Windows platforms.  

ClickFix is especially dangerous for organizations because: 

• It bypasses technical defenses — the user executes the malware themselves, making the activity look legitimate to EDR and antivirus. 

• It is cross-platform — targeting Windows, macOS, and Linux, and sometimes abusing legitimate package managers such as Homebrew on macOS. 

• It scales cheaply and quickly — attackers automate landing pages, videos, OS detection, and payload delivery. 

• It delivers high-impact threats — info-stealers, remote access trojans, and ransomware are already distributed via ClickFix and its variants (e.g., FileFix). 

For businesses, this means that endpoint protection alone is not enough. Security teams must pair behavioral detection and browser controls with threat intelligence that tracks malicious domains, payloads, and evolving social-engineering patterns. The attack surface isn’t a vulnerability in code — it’s a vulnerability in human workflows. 

ClickFix Examples: Exploring with ANY.RUN 

So, let’s see how the technique functions by finding ClickFix samples via ANY.RUN’s Threat Intelligence Lookup and observing their behavior in Interactive Sandbox.  

We can discover ClickFix analyses simply by a threat’s name – although TI Lookup allows to combine over 40 search parameters for more complicated and precise queries. We can use the name of a file, the name of a process, and even a registry key; it is possible to find malware that does a specific thing like connecting to a certain domain or making some requests.  

threatName:”clickfix” 

Example 1: Fake Updates 

Here is the first example: view a sandbox session. 

This is an example of a “fix-this” swindle persuading a user to run a command to complete a fake Windows update. What happens if they follow the instructions?  
 
mshta.exe process is initiated (utilizing a somewhat unusual IP with a “0x” in it). 

It triggers a PowerShell command that drops an .exe file. 

It reads a specific registry key to check if the user is running a certain type of virtual machine and reads the BIOS version which belongs to yet another anti-analysis trick. Pay attention to the process OOBE-Maintenance.exe: looks like it has been injected since it’s a legitimate file, but it’s loading DLLs and demonstrates very suspicious activities.  

So, we can classify this sample as malicious revealing info-stealer activity along with anti-analysis.

And here we see a malicious extension having been dropped. Google Chrome puts a lot of effort into making it hard for infostealers, but unfortunately infostealers worked around that. 

Example 2: Stealthy Classic 

Let us view another analysis. It’s a typical ClickFix pseudo-CAPTCHA:  

By running this command, we do mshta for a certain domain that drops payload. And then the system works like nothing has happened, and the CAPTCHA just worked, and everything is fine. But actually, this computer is completely pwned. A massive payload is delivered.  

Example 3: Forged CloudFlare, Actual RAT 

View sandbox analysis 

Here we see a “verification” website abusing CloudFlare services. Note that the first CAPTCHA is a genuine CloudFlare CAPTCHA:  

And then there comes the tricky one:  

This sample is not as clever as the previous one: it’s not stealthy, a PowerShell window opens up and hints that something might be amiss here.  

PowerShell spawns this GUI urging the user to click “Continue” which sends them to the actual Booking com so they might think everything is okay.  

Nothing could be further from the truth. The file travelsecurity.exe is dropped, creates persistence, and it all looks like a phishing attack.  

Example 4: FileFix and Explorer Commands 

This is a relatively new version: a Docusign scam. View analysis. 
 
If you don’t look closely, it seems to be a perfectly legit document that just requires user signature. Eric says he’s been receiving a lot of those via email, usually disguised as sponsorship offers.  

But there is the first possible-phishing red flag: the domain eu2-docusign[.]net is not a subdomain of Docusign, it masks like one using a hyphen.  

We can call this attack variant FileFix as there is no CAPTCHA, just a path to copy into Windows Explorer and open a file to be signed.

(There is also a DocFix variant that masquerade as document viewer errors, particularly targeting Microsoft Office and PDF workflows. MeetFix exploits fake Google Meet errors.)
 
So the path is copied into the Explorer address bar… And Eric is surprised that you can run commands in Explorer. The command is separated from the path by a string of spaces and is not visible for the user unless they scroll the address bar. 

What the user sees:  

What they can see after dragging their cursor to the right:  

The string runs the PowerShell command:  

And a couple of processes later we can welcome an info stealer in the system:  

How to Keep Up with New ClickFix Attacks 

So, this is how ClickFix technique works, and this is how it can be researched via Threat Intelligence Lookup and Interactive Sandbox. Over 15,000 SOC teams all over the world analyze fresh malware samples daily, generating loads of contextual data on prevalent and emerging threats.  

Use TI Lookup to check IOCs for associations with ClickFix attacks and protect proactively:  

domainName:”i-like-ele-phants-verification.live” 

Update blocklists, employ targeted preventative controls (e.g., clipboard-protection extensions, blocking certain address-bar patterns in enterprise policies), use TI to create detection rules (SIEM, EDR) that look for suspicious curl | sh, Run dialogue invocations, PowerShell one-liners, or unusual child processes after a browser session. 

Conclusion

ClickFix is a human-centric, high-ROI social-engineering technique that matured into a major vector in 2025. It’s cross-platform, fast-evolving (FileFix and other address-bar / clipboard tricks), and amplified by automated tooling and AI. 
 
As AI continues to enhance attack sophistication and lower barriers to entry, organizations must evolve their defenses beyond technical controls to include robust threat intelligence, user education, and behavioral detection. The ClickFix threat will persist and evolve—only through comprehensive, intelligence-driven security programs can organizations hope to stay ahead of this signature threat of 2025. 

FAQ 

About ANY.RUN 

Trusted by over 500,000 cybersecurity professionals and 15,000+ organizations in finance, healthcare, manufacturing, and other critical industries, ANY.RUN helps security teams investigate threats faster and with greater accuracy.     

Our Interactive Sandbox accelerates incident response by allowing you to analyze suspicious files in real time, watch behavior as it unfolds, and make confident, well-informed decisions.     

Our Threat Intelligence Lookup and Threat Intelligence Feeds strengthen detection by providing the context your team needs to anticipate and stop today’s most advanced attacks.     

Want to see it in action? 

Start your 14-day trial of ANY.RUN today →         

The post ClickFix Explosion: Cross-Platform Social Engineering Turns Users Into Malware Installers  appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

Microsoft has released its monthly security update for November 2025, which includes 63 vulnerabilities affecting a range of products, including 5 that Microsoft marked as “critical.” Current intelligence shows that one of the important vulnerabilities, CVE-2025-62215, has already been detected in the wild. 

Out of five “Critical” entries, three are remote code execution (RCE) vulnerabilities in Microsoft Windows components including GDI+, Microsoft Office, and Visual Studio. One is an elevation of privilege vulnerability affecting the DirectX Graphics Kernel. 

In the following sections we give a concise overview of the critical and important entries that are most relevant for defenders. The full catalogue of all reported issues can be found on Microsoft’s official update page. 

Exploited in the Wild 

One “important” vulnerability was confirmed to have been exploited in the wild. 

CVE-2025-62215 is a Windows Kernel elevation of privilege vulnerability, given a CVSS 3.1 score of 7.8, where a race condition in Windows Kernel allows an authorized attacker to elevate privileges locally. Microsoft assessed that the attack complexity is “low”. 

Critical Vulnerabilities 

Among all the critical vulnerabilities, none of them were labelled as exploitation more likely. Five are considered exploitation less likely. Below we describe each of those five entries. 

CVE-2025-60724 is a RCE vulnerability in GDI+, given a CVSS 3.1 score of 9.8, where a heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. The vulnerability can be triggered by convincing a victim to download and open a document that contains a specially crafted metafile. In the worst-case scenario, an attacker could trigger this vulnerability on web services by uploading documents containing a specially crafted metafile without user interaction. An attacker doesn’t require any privileges on the systems hosting the web services. Successful exploitation of this vulnerability could cause RCE or Information Disclosure on web services that are parsing documents that contain a specially crafted metafile, without the involvement of a victim user. Microsoft assessed that the attack complexity is “low”, and that exploitation is “less likely”.   

CVE‑2025‑30398 is a Nuance PowerScribe 360 information disclosure vulnerability, given a CVSS 3.1 score of 8.1, where missing authorization in Nuance PowerScribe allows an unauthorized attacker to disclose information over a network. An unauthenticated attacker could exploit this vulnerability by making an API call to a specific endpoint. The attacker could then use the data to gain access to sensitive information (including PII data) on the server. Microsoft assessed that the attack complexity is “low”, and that exploitation is “less likely”. 

CVE‑2025‑62199 is a RCE vulnerability in Microsoft Office applications, given a CVSS 3.1 score of 7.8, where a use‑after‑free flaw in Microsoft Office allows an unauthenticated attacker to execute code locally on a vulnerable workstation. To exploit this vulnerability, an attacker must send the user a malicious file and convince them to open it. Microsoft assessed that the attack complexity is “low”, and that exploitation is “less likely”.   

CVE‑2025‑60716 is a DirectX Graphics kernel elevation of privilege vulnerability, given a CVSS 3.1 score of 7, where a use‑after‑free flaw in Windows DirectX allows an authorized attacker to elevate privileges locally. Successful exploitation of this vulnerability requires an attacker to win a race condition. Microsoft assessed that the attack complexity is “high”, and that exploitation is “less likely”.   

CVE‑2025‑62214 is a RCE vulnerability in Visual Studio, given a CVSS 3.1 score of 6.7, where AI command injection in Visual Studio allows an authorized attacker to execute code locally. Exploitation is not trivial for this vulnerability as it requires multiple steps: prompt injection, Copilot Agent interaction, and triggering a build. Microsoft assessed that the attack complexity is “high”, and that exploitation is “less likely”.   

Important Vulnerabilities 

Talos would also like to highlight the following “important” vulnerabilities as Microsoft has determined that their exploitation is “more likely”:    

CVE‑2025‑59512 – Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability.  

CVE‑2025‑60705 – Windows CSC Service Elevation of Privilege Vulnerability 

CVE-2025-60719 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 

CVE-2025-62217 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 

CVE-2025-62213 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.   

In response to these vulnerability disclosures, Talos is releasing a new Snort ruleset that detects attempts to exploit some of them. Please note that additional rules may be released at a future date, and current rules are subject to change pending additional information. Cisco Security Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.  

The rules included in this release that protect against the exploitation of many of these vulnerabilities are 65496-65501, 65507-65510. There are also these Snort 3 rules: 301343-301345, 301347, 301348.  

Cisco Talos Blog – ​Read More

We recently covered the ClickFix technique. Now, malicious actors have begun deploying a new twist on it, which was dubbed “FileFix” by researchers. The core principle remains the same: using social engineering tactics to trick the victim into unwittingly executing malicious code on their own device. The difference between ClickFix and FileFix is essentially where the command is executed.

With ClickFix, attackers convince the victim to open the Windows Run dialog box and paste a malicious command into it. With FileFix, however, they manipulate the victim into pasting a command into the Windows File Explorer address bar. From a user perspective, this action doesn’t appear unusual — the File Explorer window is a familiar element, making its use less likely to be perceived as dangerous. Consequently, users unfamiliar with this particular ploy are significantly more prone to falling for the FileFix trick.

How attackers manipulate the victim into executing their code

Similar to ClickFix, a FileFix attack begins when a user is directed — most often via a phishing email — to a page that mimics the website of some legitimate online service. The fake site displays an error message preventing access to the service’s normal functionality. To resolve the issue, the user is told they need to perform a series of steps for an “environment check” or “diagnostic” process.

To do this, the user is told they need to run a specific file that, according to the attackers, is either already on the victim’s computer or has just been downloaded. All the user needs to do is copy the path to the local file and paste it into the Windows File Explorer address bar. Indeed, the field from which the user is instructed to copy the string shows the path to the file — which is why the attack is named “FileFix”. The user is then instructed to open File Explorer, press [CTRL] + [L] to focus on the address bar, paste the “file path” via [CTRL] + [V], and press [ENTER].

Here’s the trick: the visible file path is only the last few dozen characters of a much longer command. Preceding the file path is a string of spaces, and before that is the actual malicious payload the attackers intend to execute. The spaces are crucial for ensuring the user doesn’t see anything suspicious after pasting the command. Because the full string is significantly longer than the address bar’s visible area, only the benign file path remains in view. The true contents are only revealed if the information is pasted into a text file instead of the File Explorer window. For instance, in a Bleeping Computer article based on research by Expel, the actual command was found to launch a PowerShell script via conhost.exe.

What happens after the malicious script is run

A PowerShell script executed by a legitimate user can cause trouble in a multitude of ways. Everything depends on corporate security policies, the specific user’s privileges, and the presence of security solutions on the victim’s computer. In the case mentioned previously, the attack utilized a technique named “cache smuggling”. The same fake website that implemented the FileFix trick saved a file in JPEG format into the browser’s cache, but the file actually contained an archive with malware. The malicious script then extracted this malware and executed it on the victim’s computer. This method allows the final malicious payload to be delivered to the computer without overt file downloads or suspicious network requests, making it particularly stealthy.

How to defend your company against ClickFix and FileFix attacks

In our post about the ClickFix attack technique, we suggested that the simplest defense was to block the [Win] + [R] key combination on work devices. It’s extremely rare for a typical office employee to genuinely need to open the Run dialog box. In the case of FileFix, the situation is a bit more complex: copying a command into the address bar is perfectly normal user behavior.

Blocking the [CTRL] + [L] shortcut is generally undesirable for two reasons. First, this combination is frequently used in various applications for diverse, legitimate purposes. Second, it wouldn’t fully help, as users can still access the File Explorer address bar by simply clicking it with the mouse. Attackers often provide detailed instructions for users if the keyboard shortcut fails.

Therefore, for a truly effective defense against ClickFix, FileFix, and similar schemes, we recommend first and foremost deploying a reliable security solution on all employee work devices that can detect and block the execution of dangerous code in time.

Second, we advise regularly raising employee awareness about modern cyberthreats — particularly the social engineering methods employed in ClickFix and FileFix scenarios. The Kaspersky Automated Security Awareness Platform can help automate employee training.

Kaspersky official blog – ​Read More

Welcome to this week’s edition of the Threat Source newsletter. 

Ever heard the phrase in this week’s title? 

For our non-British readers, here’s the quick version: Every year on November 5, people across the U.K. gather for bonfires, sparklers, fireworks, and attempting to literally handle a hot potato. I used to love these outings as a kid, but now, as a pet owner, I tend to stay in and try to calm the poor, scared creature during the fireworks.

Anyway, Bonfire Night is all about marking the evening when the Houses of Parliament didn’t get blown to pieces with gunpowder. 

The Gunpowder Plot was the work of a group of conspirators who planned to assassinate King James I by detonating explosives beneath the House of Lords during the State Opening of Parliament on Tuesday, Nov. 5, 1605. They rented a vault in the cellars below the building, packed it with 36 barrels of gunpowder, and designated a fellow named Guy Fawkes to light the fuse. 

Unbeknownst to the conspirators, an anonymous warning (the “Monteagle Letter”) was sent to one nobleman (who was due to attend the State Opening of Parliament), suggesting he come up with some sort of excuse to miss it: 

“My lord, out of the love I bear to some of your friends, I have a care of your preservation. I would advise you, as you tender your life, to devise some excuse to shift your attendance at this Parliament; for God and man hath concurred to punish the wickedness of this time. 

…for though there be no appearance of any stir, yet I say they shall receive a terrible blow this Parliament; and yet they shall not see who hurts them.” 

Taking the warning seriously, the message was passed up the chain to Robert Cecil, the King’s chief minister, and the authorities ordered a search. Sir Thomas Knyvet, a Justice of the Peace, led a team to check the cellarsbeneath the House of Lords. There they found Fawkes guarding the barrels, carrying a lantern and some slow matches. He was arrested on the spot. 

Several of Fawkes’ co-conspirators were killed while fleeing; the rest were captured, tried, and condemned. Fawkes himself was sentenced to be hanged, drawn, and quartered — though he died instantly after leaping from the scaffold and breaking his neck. 

To this day, November 5th events across the UK include the burning of an effigy of Guy Fawkes in the middle of the bonfire. It’s always struck me as a very odd national tradition. But then again, we are a country of strange customs… such as when we chase a wheel of cheese down a near-vertical hill. 

Centuries later, Fawkes’ face was stylised into a white mask with a sly grin for the graphic novel V for Vendetta. The mask became shorthand for protest and, eventually, for hacktivism. The man who didn’t light the fuse became the symbol for people trying to spark something. And that, Alanis, is ironic. 

For the Gunpowder Plot, it was the act of someone doing the Jacobean equivalent of “better check that out,” based on some received threat intelligence. It’s a similar gut impulse that still saves many a day in modern cybersecurity settings: the analyst who follows a hunch, the responder who looks twice at a legitimate tool behaving oddly… 

By the way, if you haven’t yet, do check out our latest Cisco Talos Incident Response report. It’s such a helpful tool for analysts whose days revolve around spotting suspicious behaviour.  

For example, this quarter we saw an internal phishing campaign that was launched from compromised O365 accounts, where attackers “modified the email-management rules to hide the sent phishing emails and any replies.” As Craig pointed out in the most recent episode of The Talos Threat Perspective, he often asks his customers, “Can you effectively identify malicious inbox rules across your environment — not just for a single user’s mailbox, and not just for the last 90 days?” 

So yes, while I think it’s still a bit odd that “Remember, remember the fifth of November” commemorates a disaster that never happened, most analysts I know would drink to that.

The one big thing 

Two Tool Talks in a row? Christmas came early. 

With the latest article, Cisco Talos’ Martin Lee explores how to empower autonomous AI agents with cybersecurity know-how, enabling them to make informed decisions about internet safety, such as evaluating the trustworthiness of domains. He demonstrates a proof-of-concept using LangChain and OpenAI, connected to the Cisco Umbrella API, so that AI agents can access real-time threat intelligence and make smarter security choices. 

Why do I care? 

As AI agents become more autonomous and interact with the internet on your behalf, their ability to distinguish safe from unsafe sites directly impacts your digital security. Equipping AI with real-time threat intelligence means fewer mistakes and better protection for your data and devices in an evolving threat landscape. 

So now what? 

If you work with or develop AI systems, consider incorporating real-time threat intelligence APIs like Cisco Umbrella to enhance your agents’ decision-making. As this technology evolves, staying informed and adapting these best practices will help ensure both your users and AI agents make safer choices online.

Top security headlines of the week 

CISA: High-severity Linux flaw now exploited by ransomware gangs 
Potential impact includes system takeover once root access is gained (allowing attackers to disable defenses, modify files, or install malware), lateral movement through the network, and data theft. (Bleeping Computer) 

Phone location data of top EU officials for sale, report finds 
Journalists in Europe found it was “easy” to spy on top European Union officials using commercially obtained location histories sold by data brokers, despite the continent having some of the strongest data protection laws in the world. (TechCrunch) 

Poland hit by another major cyberattack 
Polish authorities are investigating a large-scale cyberattack that compromised personal data belonging to clients of SuperGrosz, an online loan platform, Deputy Prime Minister and Minister for Digital Affairs Krzysztof Gawkowski confirmed. (Polskie Radio) 

Conduent admits its data breach may have affected around 10 million people 
The breach lasted nearly three months. Conduent is a major government contractor and works with more than 600 government entities globally, including those on state, local, and federal levels, and a majority ofFortune 100 companies. (Tech Radar) 

The password for the Louvre’s video surveillance system was “Louvre”
Experts have been raising concerns about the museum’s security for more than a decade. In 2014, the museum’s video surveillance server password was “LOUVRE,” while a software program provided by the company Thales was secured with a password “THALES.” (Cybernews)

Can’t get enough Talos? 

Tales from the Frontlines 
On Wednesday, Nov. 12, hear Talos IR share candid stories of critical incidents last quarter, how we handled them, and what they mean for your organization. Registration is required. 

Harnessing threat intel in Hybrid Mesh Firewall 
Join us on Thursday, Nov. 13 to learn how Talos combines expert human research with advanced AI/ML to detect and stop emerging threats. 

Dynamic binary instrumentation (DBI) with DynamoRio 
This blog introduces DBI and guides you through building your own DBI tool with the open-source DynamoRIO framework on Windows 11.

Upcoming events where you can find Talos 

• DeepSec IDSC (Nov. 18 – 21) Vienna, Austria 
• AVAR (Dec. 3 – 5) Kuala Lumpur, Malaysia

Most prevalent malware files from Talos telemetry over the past week 

SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507  
MD5: 2915b3f8b703eb744fc54c81f4a9c67f  
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507  
Example Filename: e74d9994a37b2b4c693a76a580c3e8fe_1_Exe.exe  
Detection Name: Win.Worm.Coinminer::1201 

SHA256: 41f14d86bcaf8e949160ee2731802523e0c76fea87adf00ee7fe9567c3cec610  
MD5: 85bbddc502f7b10871621fd460243fbc  
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=41f14d86bcaf8e949160ee2731802523e0c76fea87adf00ee7fe9567c3cec610  
Example Filename: 85bbddc502f7b10871621fd460243fbc.exe  
Detection Name: W32.41F14D86BC-100.SBX.TG 

SHA256: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974 
MD5: aac3165ece2959f39ff98334618d10d9  
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974  
Example Filename: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974.exe  
Detection Name: W32.Injector:Gen.21ie.1201 

SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91  
MD5: 7bdbd180c081fa63ca94f9c22c457376  
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91  
Example Filename: e74d9994a37b2b4c693a76a580c3e8fe_3_Exe.exe  
Detection Name: Win.Dropper.Miner::95.sbx.tg 

SHA256: d933ec4aaf7cfe2f459d64ea4af346e69177e150df1cd23aad1904f5fd41f44a  
MD5: 1f7e01a3355b52cbc92c908a61abf643  
Talos Rep: https://talosintelligence.com/talos_file_reputation?s=d933ec4aaf7cfe2f459d64ea4af346e69177e150df1cd23aad1904f5fd41f44a  
Example Filename: cleanup.bat  
Detection Name: W32.D933EC4AAF-90.SBX.TG 

Cisco Talos Blog – ​Read More