Loading malware…
22 distinct techniques documented for this family, organized by ATT&CK tactic.
CleverSoar employs a persistence mechanism by executing a scheduled task upon user login (T1053).
If the service is not detected, the installer opens a named '\\.\pipe\ntsvcs' pipe ... to establish a temporary service responsible for creating the 'CleverSoar' service (T1569.002).
CleverSoar employs a persistence mechanism by executing a scheduled task upon user login (T1053).
Subsequently, the installer creates the 'HKCU\SOFTWARE\Magisk' (T1112) registry key
The CleverSoar installer modifies the processes mitigation policy to include the restriction 'Signatures restricted (Microsoft only)' (T1543).
If the service is not already in existence, it proceeds to execute the command 'sc create Nidhogg ...' to create a new 'Nidhogg' service (T1543.003).
CleverSoar employs a persistence mechanism by executing a scheduled task upon user login (T1053).
If one of these processes is discovered, the installer proceeds to adjust 'Se_Debug_Privilege' ... searches for 'lsass.exe' and writes into that process (T1055).
The installer begins by verifying the existence of the 'C:\cs' folder.It subsequently checks if the process is elevated by executing 'GetTokenInformation' and passing 'TokenElevation' (0x14) as a TokenInformationClass (T1134).
If the process is not elevated, the malware will utilize the 'runas' operation of 'ShellExecuteA' to execute the process with Administrator privileges (T1134.002).
The CleverSoar installer modifies the processes mitigation policy to include the restriction 'Signatures restricted (Microsoft only)' (T1543).
If the service is not already in existence, it proceeds to execute the command 'sc create Nidhogg ...' to create a new 'Nidhogg' service (T1543.003).
The service will execute an open-sourced Nidhogg rootkit at system startup (T1014).
If one of these processes is discovered, the installer proceeds to adjust 'Se_Debug_Privilege' ... searches for 'lsass.exe' and writes into that process (T1055).
The installer begins by verifying the existence of the 'C:\cs' folder.It subsequently checks if the process is elevated by executing 'GetTokenInformation' and passing 'TokenElevation' (0x14) as a TokenInformationClass (T1134).
If the process is not elevated, the malware will utilize the 'runas' operation of 'ShellExecuteA' to execute the process with Administrator privileges (T1134.002).
Given our high confidence that the malicious files were dropped by a .msi package (T1218.007)
In our instance, the installer checks for 'QEMU' ... presence in the returned buffer (T1497.001).
The created task is concealed by modifying the 'Index' value under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Corp' registry key to 0 (T1564).
CleverSoar installer enumerates the files present in the folder generated by the malware and modifies their attributes by adding 0x6 (FILE_ATTRIBUTE_HIDDEN + FILE_ATTRIBUTE_SYSTEM). This modification is intended to evade file detection mechanisms (T1564.001).
The installer also executes timing anti-debug checks by invoking the 'GetTickCount64' function twice ... (T1622).
Subsequently, the installer creates the 'HKCU\SOFTWARE\Magisk' (T1112) registry key
The installer is also responsible for disabling security solutions (T1562.001)
After persistence set, the installer turns the Windows firewall off by executing the 'netsh advfirewall set allprofiles state off' command (T1562.004).
Subsequently, it enumerates the currently running processes once more (T1057), searching for any instances that contain one of the following strings
Initially, the installer verifies the operating system version by invoking the 'GetVersionExW' function (T1082).
In our instance, the installer checks for 'QEMU' ... presence in the returned buffer (T1497.001).
Next, it enumerates processes and checks if one of 'ZhuDongFangYu.exe', 'QHActiveDefense.exe', 'HipsTray.exe', or 'HipsDaemon.exe' is running (T1518.001).
The installer is also responsible for disabling security solutions (T1562.001) and making sure to infect only machines with Chinese or Vietnamese system languages (T1614.001).
The installer also executes timing anti-debug checks by invoking the 'GetTickCount64' function twice ... (T1622).
This technical analysis will cover the CleverSoar installer used to evasively deploy the Nidhogg rootkit, Winos4.0 framework and the custom backdoor (T1105).
Upon our examination of the Sysmon driver, this action results in the termination of the identified process (T1489).
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.