PSYC-OTX-6a21aa7db4b7cf1351f27cb6

OTX: ClickFix Deno Abuse to CastleRAT

The full record for one case — how Classifyline rated it, what Scoutline observed, the evidence Sealine encrypted, where Routeline may send it, and every ledger entry it produced.

how to use this view

How to use. Read the cards top-to-bottom — classification, observables, sealed package, routes, ledger. Hit ▶ case journey for the animated walk-through.

What you're seeing. Every worker line's output for this one case: how it was rated, what was observed, what was encrypted and to whom, where it would route, and the audit rows it produced.

Why it matters. Nothing sensitive leaves psyc without a human seeing the full reasoning chain — this page is that chain, for one case.

Classification

Severity: medium
TLP: GREEN
Incident type: malware
Internal class: D

Confidence

Level: medium
Source reliability: C
Information credibility: 3

Source

Type: threat_intel
Reference: https://otx.alienvault.com/pulse/6a21aa7db4b7cf1351f27cb6
Observed: 2026-06-04 16:40 UTC
Ingested: 2026-06-07 00:17 UTC

Observables

URLs

http://webstizkgao.com/v02c4fd90de22ee0677.js
http://webstizkgao.com/v2c4fd90de22ee0677.js
http://162.33.177.16/CFBatFIX/install.pyc
http://162.33.177.16/CFBatFIX/7sjVtn0zPVjMZzkxZ.MOa

Domains

lkczkqweca.com
smokeenew.com
ibewfszvehhb.lkczkqweca.com
webstizkgao.com
webstizkgao.com
162.33.177.16
nicenicc.com

IPs

162.33.177.16

Hashes

f1ecb89facb7e31ee9c03278f4106113c0339ff9fc10b1aefe33aaab776e8540
f704a49c0cdaaae4515105bf937e26b5e39b1101c8a0cefaca3959fce7418e9d
82056127b671583deb500d931ecb893224c34d3b8de66c0959700d55a1bfbbfd
c9afa1e8ce84b3af50304b504519a587488658142137cf4bbf85f5780c06f682
b04bc0780b2cd11fde488372387f557a87fd473ba546295f5fca7771d5b8a394

Routes

2 allowed · 2 blocked

MISP-Community priority 2 · stix_indicators · max_tlp AMBER

URLhaus priority 3 · malware_url_report · max_tlp GREEN

CERT-Bund country_mismatch

AbuseIPDB tlp_exceeded