General

  • Target
    clash-for-windows-setup.exe
  • Size 16.2MB
  • Sample260802-wt9p5sdq91
  • SHA256 027f3a559be3fae3c56ba76db5363fdf3f7c83cb7fd2798df41e7d447f602550
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Targets

    • Target
      clash-for-windows-setup.exe
    • Size 16.2MB
    • SHA256 027f3a559be3fae3c56ba76db5363fdf3f7c83cb7fd2798df41e7d447f602550
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 15KB
    • SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      $PLUGINSDIR/StartMenu.dll
    • Size 7KB
    • SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      $PLUGINSDIR/UserInfo.dll
    • Size 4KB
    • SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      $PLUGINSDIR/nsis_tauri_utils.dll
    • Size 29KB
    • SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    • Target
      Clash for Windows.exe
    • Size 8.4MB
    • SHA256 bc175660acdb665a58acd6e01b8f3c8553bbf58a503511be1674c5fbe1372370
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Target
      clash-meta.exe
    • Size 26.4MB
    • SHA256 ac8650b0fa158922ce73f144df11b5d00d03a651123cf9ed94177ee4550fd847
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      clash.exe
    • Size 26.4MB
    • SHA256 ac8650b0fa158922ce73f144df11b5d00d03a651123cf9ed94177ee4550fd847
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      resources/clash-verge-service.exe
    • Size 819KB
    • SHA256 d5b0eec51154c066ede97201b3f28c95372096b4ae260df87de8608c00b112e6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      resources/install-service.exe
    • Size 159KB
    • SHA256 4d477bf0ed5747fe57f9a44a1997da8b0bee11d99f1d19fed010556dedd52f78
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      resources/uninstall-service.exe
    • Size 141KB
    • SHA256 4559bf18e2b118200db3b8f150a30c119779280aac439fab2163e92a908d4539
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      resources/wintun.dll
    • Size 417KB
    • SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    • Target
      uninstall.exe
    • Size 94KB
    • SHA256 4803c167e1175a72b66682c8f7c06b9f5014b798c4d9915bc0cdcb5244778705
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 5KB
    • SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
3/10

behavioral1

discovery
Score
7/10

behavioral2

discovery
Score
7/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

defense_evasiondiscoverytrojan
Score
6/10

behavioral16

defense_evasiondiscoverytrojan
Score
6/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

discovery
Score
7/10

behavioral30

discovery
Score
7/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10