203bf29f7a5f0dc5fbc5e42772de6a474501603a19120c2f1259bb27c067df51

Sharing

Copy URL Twitter E-mail

General

Target
Clash.Verge_2.5.1_x64-setup.exe
Size 44.9MB
Sample260629-wt21asbv91
SHA256 203bf29f7a5f0dc5fbc5e42772de6a474501603a19120c2f1259bb27c067df51
MD5 726b4114172d3af73e6deb52d52873f9
SHA1 e8837f2c223ebfe4c9703fc0b080cfb9ee5a364a
SHA512 841577795207788629050ae3813122e8a6d882cce0aae56d0e213009d26fa1e1bc5326ba01c5595ccf8d4bfa2d967a75cbda390620f133ac91dae928a33252fe
SSDEEP 786432:BLR8F6BvAHI0ooazvRsF0wx6C2/NF6HGZRXYhl5+szEYmdY6yf/dq7f4kfVz2lUB:BLSF6WHVnazvR9LC2/NumYhl5ArYzddk
TLSH
T1A8A733EAA32C5418DAD1183319EC4C98D1C2DD05BAD551AED3AC3A147E0C89E4EBDEF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Clash.Verge_2.5.1_x64-setup.exe
- Size 44.9MB
- SHA256 203bf29f7a5f0dc5fbc5e42772de6a474501603a19120c2f1259bb27c067df51
- MD5 726b4114172d3af73e6deb52d52873f9
- SHA1 e8837f2c223ebfe4c9703fc0b080cfb9ee5a364a
- SHA512 841577795207788629050ae3813122e8a6d882cce0aae56d0e213009d26fa1e1bc5326ba01c5595ccf8d4bfa2d967a75cbda390620f133ac91dae928a33252fe
- SSDEEP 786432:BLR8F6BvAHI0ooazvRsF0wx6C2/NF6HGZRXYhl5+szEYmdY6yf/dq7f4kfVz2lUB:BLSF6WHVnazvR9LC2/NumYhl5ArYzddk
- TLSH
  T1A8A733EAA32C5418DAD1183319EC4C98D1C2DD05BAD551AED3AC3A147E0C89E4EBDEF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware trojan
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1
- Target
  $PLUGINSDIR/LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH
  T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
- MD5 8eabbe36e8b52e69322780d0f541fd19
- SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
- SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
- SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
- TLSH
  T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/SimpleSC.dll
- Size 1.1MB
- SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
- MD5 7b89329c6d8693fb2f6a4330100490a0
- SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
- SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
- SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
- TLSH
  T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
- MD5 b9b71990b37e04a56cadbcbfa694f30f
- SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
- SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
- SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
- TLSH
  T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH
  T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH
  T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH
  T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
- MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
- SHA1 75197fee3c6a814fe035788d1c34ead39349b860
- SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
- SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
- TLSH
  T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral9
- Target
  $TEMP/MicrosoftEdgeWebview2Setup.exe
- Size 1.6MB
- SHA256 cb9b76a6dace90f5d4635f2d49cbb55a62f41e5e365a22cef4265c013af0bcdd
- MD5 7d771a8de0076f9fc5169cf1ba088586
- SHA1 180865c9fb67008f5f1900350be6bfd10c4ac0a1
- SHA512 1143ac711e8589b7918091306b99ce70f534b0b6aa8c820dfb080f1d567969cdff2948a46adf3de36efdfd96715f214469c2c678eb6ffa494a970c0a14b7c472
- SSDEEP 49152:X0iGA3AiBEIBB/4lR9Sk2qzV3dJnRoj8:Eix/7/4PzV3dlA8
- TLSH
  T14275222476D48031E5F3293159F4CAB25F7AFDB24A72598F13520E2D2E35AE2E235363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10
- Target
  clash-verge.exe
- Size 47.2MB
- SHA256 e7d5b91b76f502f02255aac89dbd79fa7e51f7ede867749f2c63861b2d811a28
- MD5 7a3bacf6d70bc135babe20fce9b910f0
- SHA1 62e535cd55dd3364b4f3d25af8d42a535e50968e
- SHA512 598acff9605798cb92811e7e8db8b3abdc57952071e636f6d571db3a5187bcd81a5d56480e65c38cce53a615c5f3dd3662e6b43e5839152c867d1ca5793e9576
- SSDEEP 393216:wkBqbPr4cntu7f2a0vKafnIcN/jhwmD5scnJfnREVl7Tw:wkByPr4cnI7+aWKVi/jHDNJulHw
- TLSH
  T14AB716157A5FA96EC45AC8B0824A4A735E2134DB0A36B9BF44C442353F7EBF42B3D748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral11
- Target
  resources/clash-verge-service-install.exe
- Size 171KB
- SHA256 ea73082094d12a0782389667b9a608ceed3814df442eed25ba9b56820d0a1a1d
- MD5 9da7abf96be07992d516ccaa42bc8537
- SHA1 839cc4df0d2bebfd6125f55af564b71473fee313
- SHA512 0a9d5fe23afa31efd517af3857f040411815dee8b70c48263a97fe65d395c1c0a5f16e88a15ef0340695e9c68e26422433d2414da58b37bf0897c41b20ceb3e3
- SSDEEP 1536:TWNPqB+pv9M1Qn0/OVCZPfht5mpjDI2Xw6jwUz5m9JuUH1snVYtEXsxvy9ZtYkwW:TWNnpjnluhDOnIx6fVUH0XsxuZ+8JB
- TLSH
  T1A7044B63FA5691FCD45AC078C3159563BA77B8C90F2269FF026512383E69EE17F38A10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral12
- Target
  resources/clash-verge-service-uninstall.exe
- Size 152KB
- SHA256 1cdfcfc3cab2f26ed4e62fbce128bc58b6d5c2a3d435bfc8042a5051e288350f
- MD5 ca0231511f8c4add294871f451bfd838
- SHA1 a988379ab70ab01d71d9781a044aa4566a7a94f6
- SHA512 b173dbf45b4740caf5e77bafe043201a72f6844363315efbcae1679840066b7488a7959070c9645c8548483f8170600ea7dcbd459d5ce00ead7fde5d29a14087
- SSDEEP 3072:Vc0WOb6jQ3QtaOEnt1UN9+OD+cGe1HWFufk:VP6jmQtDEzUNvDRGe19
- TLSH
  T1ADE35C137951A1F8E01BC07CC3159A73B736B8C51F2269FF166416382E69EE97F38A50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  resources/clash-verge-service.exe
- Size 1.7MB
- SHA256 92ad792abb91bd84b89894e63a8251434a631a5803d9d043c18f7a5a7961e9d2
- MD5 f992435c52564c74c56606e1b9376658
- SHA1 e148f357dc29277e9f2a98c4178924e47c04f660
- SHA512 a46687a8c0da79bb80d62999a9216f90ec99a73a86c82a3608041037754465c9d8c8767eefa6bcc4a1a2b6198e6a9ff93aeccc693b528e0fc10c83b92766fbca
- SSDEEP 24576:T9+uwx7kUK6dU9y33enQhtbN9Nyx4T8qid1Ef+5iBETFuAc3dl/vA53A5gYH:TdK7rK6dlN9vfzyFuAc3dl/vA5Q5gY
- TLSH
  T19B855B03FA66C0ECC56EC078C3566232BA72B88A073579EB56945A353E65FE06F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  resources/enableLoopback.exe
- Size 82KB
- SHA256 f0c328376bd5ae0ef3b0eb19ac1f343c24a9abfe7bc1008d3b2f6ef3573d04d1
- MD5 d6d0eeb5a95606ddde1ab29bfb66969e
- SHA1 499937e698e9a62ccc7a5118d132a91c646f556e
- SHA512 dabab25522b53ab10c25e4ad872801957fa59c1067861909d762ed796589523eddbe9cdfa00e8c7b0b411b7a1558bad4f720c3ad43ab81058ffd3215cd13a203
- SSDEEP 768:kREI16zcI2eupxmhm/ljPb0O7/Al25znrShUAEg4CqnZI6qmmlk1QPFLCxf1ml0n:e1HLdwOLFzrShU+wZ9xmlk11fIbW
- TLSH
  T13A8317003BE84266F6FA8B759572E4509B79BD5B48B0E6CD2DD4B49F09F3B408321727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  verge-mihomo-alpha.exe
- Size 44.1MB
- SHA256 76bb1f090fe44f222b88a504b51fe73f90d76e40830382fba54b5c1b00f6ba83
- MD5 b69f7e28a10ebf934bc70ff26e450190
- SHA1 b77cec7b0f6b40c0e5c5ec7e14c72ac92f9a46ce
- SHA512 c72e9712f886bc4542eef223f5003c6c9b11b79b93b7a40a1534218b86ea9578ee14cfdecaeeb5ddc2abbfc734a47ec3a36b90cd967e257870df08eceea3e2f7
- SSDEEP 196608:yu0D183qI7DJjTBsvQve3EuEBrG8t8364EzSLiEhoJBHruVjHdZ5Zc:y7G3qIbKke3is64EzSLFo3L6H1y
- TLSH
  T146A7394BF8564CE4F9ADC438C5A682137B703C69972523D71B20FA146F7EBD06ABA350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  verge-mihomo.exe
- Size 44.0MB
- SHA256 c897eeb215ab3c67e7a73267e4a5169b609d0821d4164d3fffc039aa58ff4521
- MD5 b2a3b3328a8734ee64ff412e0499a24a
- SHA1 8dcc76b3c029bf61799dd23fc2410e06c2b91b29
- SHA512 439a76daf5a3ac5ff689e0e5462bbbd979ff2be8943b2a9e795574641ca4480c3831c40313cab3be1dbb8d04e8562f7a0d3972edb65fd09cfe8c7ce9155df201
- SSDEEP 196608:fvugFNQzrpzY7P8WewbS9FFQRA38EXEx8F6AiEk88o63J74HTM2VUP5Zc:f2WNQzr64mSN3F64k88oc78CRy
- TLSH
  T189A74B5BF8654CE8E9ADC534C5A682137B707C69572423D71B20FA242F3EBD06AFA350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17