Clipsa

At this point, Clipsa attempts to get the WordPress site’s admin username. To achieve this, the malware executes a simple HTTP request for user enumeration... http(s)://website.example/?author=1

In the PARSE phase... Every site from the search engine results page is parsed and saved into separate files on the disk... All these unique URLs are then continually visited by new requests: http(s)://website.example/xmlrpc.php

When Clipsa successfully brute-forces its way into a WordPress admin account, it creates a string with all the information it obtained in the process: fingerprint|GOOD|www.website.example|admin’s username|password

it also registers itself into Task Scheduler with a somewhat ironic name, using the following command: cmd.exe /c SCHTASKS /Create /SC MINUTE /MO 2 /TN "Microsoft Malware Protection Command Line Utility" /TR "C:\Users\user\AppData\Roaming\Host\svchost.exe"

At first, its Base64-encoded overlay is decoded, creating a new PowerShell script. This script decodes a GZIP file from another Base64-encoded string.

it also registers itself into Task Scheduler with a somewhat ironic name, using the following command: cmd.exe /c SCHTASKS /Create /SC MINUTE /MO 2 /TN "Microsoft Malware Protection Command Line Utility" /TR "C:\Users\user\AppData\Roaming\Host\svchost.exe"

When Clipsa successfully brute-forces its way into a WordPress admin account, it creates a string with all the information it obtained in the process: fingerprint|GOOD|www.website.example|admin’s username|password

the path to condlg.exe is added to registry autorun, assuring the malware’s persistence: HCU\Software\Microsoft\Windows\CurrentVersion\Run\11f86284

it also registers itself into Task Scheduler with a somewhat ironic name, using the following command: cmd.exe /c SCHTASKS /Create /SC MINUTE /MO 2 /TN "Microsoft Malware Protection Command Line Utility" /TR "C:\Users\user\AppData\Roaming\Host\svchost.exe"

When Clipsa successfully brute-forces its way into a WordPress admin account, it creates a string with all the information it obtained in the process: fingerprint|GOOD|www.website.example|admin’s username|password

the path to condlg.exe is added to registry autorun, assuring the malware’s persistence: HCU\Software\Microsoft\Windows\CurrentVersion\Run\11f86284

Clipsa spreads as a malicious executable file, likely disguised as codec pack installers for media players... the malware displays an error message to the users, to make the users believe the codec installation failed.

When Clipsa successfully brute-forces its way into a WordPress admin account, it creates a string with all the information it obtained in the process: fingerprint|GOOD|www.website.example|admin’s username|password

Clipsa checks whether Task Manager is running using Windows Management Instrumentation (WMI)... and if it is running, terminates the program to avoid user detection.

The BRUTE phase serves a single purpose: Brute-force its way into the administrative privileges of the WordPress website and send brute-forced credentials to the poly.ufxtools[.]com file repository.

Once it finds a vulnerable site, it attempts to brute-force its way into the site, sending the valid login credentials to Clipsa’s C&C servers.

Clipsa checks whether Task Manager is running using Windows Management Instrumentation (WMI)... and if it is running, terminates the program to avoid user detection.

one of the threads periodically checks the following list of active processes: taskmgr.exe procexp64.exe procexp.exe processhacker.exe procmon.exe wireshark.exe

Clipsa is capable of searching for and stealing wallet.dat files... Furthermore, Clipsa also finds all text files (*.txt) which contain bip-39 patterns.

The clipboard is continuously checked and validated if its contents match Bitcoin (BTC) or Ethereum (ETH) address formats. If an address in the correct format is found, Clipsa replaces the address with the most similar BTC address from a predefined list.

If any such files are present, they are encrypted by RC4 stream cipher and sent to the poly.ufxtools[.]com file repository.

If poly.ufxtools[.]com is alive, the malware proceeds with downloading and executing an XMRig coinminer.

After the upload is completed, the malware deletes the contents of the rep.dat file... Clipsa then tries to upload these files to the poly.ufxtools[.]com C&C server.

Several versions of Clipsa also deploy an XMRig coinminer to make even more money from infected computers.