{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/fake-clawdbot-vs-code-extension-deploys-screenconnect-rat/",
    "fang": "live",
    "exported_at": "2026-07-15T22:31:14Z",
    "total": 24,
    "categories": 4
  },
  "iocs": {
    "IPv4": [
      "178.16.54.253",
      "179.43.176.32"
    ],
    "Domains": [
      "clawdbot.getintwopc.site",
      "darkgptprivate.com",
      "getintwopc.site",
      "meeting.bulletmailer.net",
      "www.aikido.dev",
      "www.dropbox.com"
    ],
    "URLs": [
      "bulletmailer.net",
      "darkgptprivate.com",
      "dropbox.com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate.msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&amp",
      "getintwopc.site",
      "getintwopc.site/config.json",
      "getintwopc.site/config.json&#x27",
      "http://clawdbot.getintwopc.site/config.json&#x27",
      "http://clawdbot.getintwopc.site/dl/Lightshot.dll&#x27",
      "http://clawdbot.getintwopc.site/dl/Lightshot.exe&#x27",
      "https://darkgptprivate.com/d111&quot",
      "https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware",
      "https://www.dropbox.com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate.msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&st=q93av9p6&dl=1"
    ],
    "sha256": [
      "04ef48b104d6ebd05ad70f6685ade26c1905495456f52dfe0fb42f550bd43388",
      "adbcdb613c04fd51936cb0863d2417604db0cd04792ab7cae02526d48944c77b",
      "d1e0c26774cb8beabaf64f119652719f673fb530368d5b2166178191ad5fcbea",
      "e20b920c7af988aa215c95bbaa365d005dd673544ab7e3577b60fecf11dcdea2"
    ]
  }
}