Overview
overview
8Static
static
3Clash.Verg...up.exe
windows7-x64
8Clash.Verg...up.exe
windows10-2004-x64
7$PLUGINSDI...ID.dll
windows7-x64
3$PLUGINSDI...ID.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...SC.dll
windows7-x64
3$PLUGINSDI...SC.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$TEMP/Micr...up.exe
windows7-x64
8$TEMP/Micr...up.exe
windows10-2004-x64
8Clash Verge.exe
windows7-x64
1Clash Verge.exe
windows10-2004-x64
1clash-meta-alpha.exe
windows7-x64
1clash-meta-alpha.exe
windows10-2004-x64
1clash-meta.exe
windows7-x64
1clash-meta.exe
windows10-2004-x64
1resources/...ce.exe
windows7-x64
1resources/...ce.exe
windows10-2004-x64
1resources/...ck.exe
windows7-x64
1resources/...ck.exe
windows10-2004-x64
5resources/...ce.exe
windows7-x64
1resources/...ce.exe
windows10-2004-x64
1resources/...ce.exe
windows7-x64
1resources/...ce.exe
windows10-2004-x64
1Analysis
-
max time kernel
129s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-08-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
Clash.Verge_1.5.4_x64-setup.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Clash.Verge_1.5.4_x64-setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ApplicationID.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/SimpleSC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$TEMP/MicrosoftEdgeWebview2Setup.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$TEMP/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Clash Verge.exe
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
Clash Verge.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
clash-meta-alpha.exe
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
clash-meta-alpha.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
clash-meta.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
clash-meta.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
resources/clash-verge-service.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
resources/clash-verge-service.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
resources/enableLoopback.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
resources/enableLoopback.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
resources/install-service.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
resources/install-service.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
resources/uninstall-service.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
resources/uninstall-service.exe
Resource
win10v2004-20240802-en
General
-
Target
resources/enableLoopback.exe
-
Size
95KB
-
MD5
5d16400084f534535c922180c562bd70
-
SHA1
20444c63a2e6ff17a1970f8af0744c0ccfdbb659
-
SHA256
0ccf6f4b2f6e89ddb50b3075fd6b604ef7c0d6b13ce377781d898dcd8f9c91d7
-
SHA512
b9dc50aac871ff81c54e000adb1de11c17aeea75fbc80afa5f025d1efe6c79acbfd05b5de6066f084ed0e26d4287c354984195e7aa134545846d371f84063bd0
-
SSDEEP
768:izEI16zcI2eTcvEWm/ljPjOPAxr25znrSh7A8g3CqnZZ6qmmlGThRR2fTnR2fTT0:y1H5MiP1zrSh7JwZQxmlGKyn6hb
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation enableLoopback.exe