# The Proxifier Trap: Analyzing the ClipBanker Marathon Infection Chain ## Executive Summary Threat actors are increasingly leveraging trusted developer tools and open-source platforms to bypass traditional security perimeters. Recently, SecLookup tracked a sophisticated campaign distributing the **ClipBanker** malware through trojanized versions of "Proxifier," a popular network utility. This campaign is notable for its "marathon" infection chain, utilizing multi-stage execution, process injection, and "exotic" defense evasion techniques. By abusing GitHub Releases and employing specialized PowerShell execution methods, the attackers successfully circumvented Microsoft Defender to deploy a clipboard-swapping module designed to steal cryptocurrency. SecLookup’s threat intelligence platform has been actively detecting and blocking the malicious infrastructure associated with this campaign, including the primary command-and-control (C2) domain `maper.info`. ## Threat Analysis: The Infection Lifecycle The ClipBanker campaign begins with a classic social engineering tactic: SEO poisoning and the exploitation of developer trust. ### Stage 1: Initial Access and Delivery The infection typically starts with a user searching for "Proxifier" via a web search engine. The attackers successfully positioned a malicious GitHub repository near the top of the search results. While the repository itself contains a rudimentary, legitimate-looking proxy service, the **Releases** section contains the payload: a ZIP archive containing a malicious executable and a text file with "activation keys." The executable is a malicious wrapper. When launched, it installs the legitimate Proxifier software to maintain the illusion of functionality while simultaneously initiating a silent, multi-stage infection in the background. ### Stage 2: Exotic Defense Evasion The malware's primary objective upon execution is to disable security protections. To avoid detection by Microsoft Defender, the Trojan employs a sophisticated multi-step process: 1. **The Donor Process:** The Trojan creates a 1.5 KB stub file in the temporary directory (named `Proxifier.tmp`). This file is functionally benign and serves only as a "donor" process. 2. **Process Injection:** A .NET-based component named `api_updater.exe` is injected into the running donor stub. 3. **In-Memory PowerShell Execution:** To set Defender exclusions without triggering command-line logging or spawning `powershell.exe`, the malware uses the **PSObject** class within the .NET environment. This allows the script to run directly within the current process memory. The PowerShell script executed via `PSObject` specifically adds exclusions for all `.tmp` extensions and the current working directory, effectively creating a "blind spot" for the next stages of the malware to operate within. ### Stage 3: The ClipBanker Payload Once the environment is prepared and defenses are impaired, the trojanized installer extracts and launches the final payload. ClipBanker is a specialized Trojan that monitors the system clipboard for patterns matching cryptocurrency wallet addresses (Bitcoin, Ethereum, etc.). When a match is found, the malware replaces the user's intended destination address with one controlled by the attacker. This results in the user inadvertently sending funds to the threat actor during a transaction. ## MITRE ATT&CK Mapping | Tactic | Technique | ID | Details | | --- | --- | --- | --- | | **Initial Access** | Supply Chain Compromise: Trojanized Software | T1195.002 | Use of trojanized "Proxifier" installers on GitHub. | | **Execution** | Command and Scripting Interpreter: PowerShell | T1059.001 | Using PowerShell via `PSObject` for stealth. | | **Defense Evasion** | Impair Defenses: Disable or Modify Tools | T1562.001 | Modifying Microsoft Defender exclusions. | | **Defense Evasion** | Process Injection | T1055 | Injecting `api_updater.exe` into a donor stub. | | **Impact** | Data Manipulation: Stored Data Manipulation | T1491 | Modifying clipboard data to redirect crypto transactions. | ## SecLookup Detection and Protection SecLookup’s threat intelligence engine has been actively monitoring the infrastructure supporting this ClipBanker campaign. Our platform identified the domain `maper.info` as a critical component of the distribution and command chain. SecLookup users were protected via: * **Real-time Domain Blocking:** The domain `maper.info` was flagged as malicious and blocked across protected endpoints. * **Hash Identification:** The specific file hashes for `api_updater.exe` and the trojanized Proxifier wrappers were added to our global blacklist. * **Behavioral Heuristics:** Our platform detects the specific sequence of adding Defender exclusions via unconventional PowerShell callers. ## Indicators of Compromise (IOCs) The following indicators have been identified and confirmed as part of this campaign. ### Malicious Domains ```text maper.info ``` ### File Hashes ```text d85cef60cdb9e8d0f3cb3546de6ab657f9498ac7 8354223cd6198b05904337b5dff7772b 7528bf597fd7764fcb7ec06512e073e0 107484d66423cb601f418344cd648f12 34a0f70ab100c47caaba7a5c85448e3d 97c16182d2e91a9370d5590b670f6b8dc755680552e40218a2b28ec7ad105071 ``` ### Network URLs ```text https://pinhole.rootcode.ru/rogers7/dev-api/raw/master/cpzn https://chiaselinks.com/raw/nkkywvmhux https://maper.info/2X5tF5 https://gist.github.com/msfcon5ol3/107484d66423cb601f418344cd648f12/raw/d85cef60cdb9e8d0f3cb3546de6ab657f9498ac7/upxz https://git.parat.swiss/rogers7/dev-api/raw/master/cpzn https://snippet.host/aaxniv/raw https://github.com/lukecodix/Proxifier/releases/download/4.12/Proxifier.zip https://pastebin.com/raw/FmpsDAtQ https://paste.kealper.com/raw/k3K5aPJQ https://rlim.com/55Dfq32kaR/raw ``` ## Detection Rules ### YARA Rules The following YARA rules can be used to hunt for artifacts associated with this ClipBanker campaign in your environment. ```yara rule Trojan_ClipBanker_Defender_Exclusion { meta: description = "Detects malicious .NET behavior adding Defender exclusions for .tmp extensions using PSObject" author = "SecLookup Threat Intel" threat_name = "ClipBanker" strings: $s1 = "Add-MpPreference" wide ascii $s2 = "-ExclusionExtension" wide ascii $s3 = ".tmp" wide ascii $s4 = "-ExclusionPath" wide ascii $p1 = "System.Management.Automation.PSObject" wide ascii $f1 = "api_updater.exe" wide ascii condition: uint16(0) == 0x5A4D and (all of ($s*) or (3 of ($s*) and ($p1 or $f1))) } rule Trojan_ClipBanker_Infection_Artifacts { meta: description = "Detects specific file names and indicators associated with the ClipBanker infection chain" author = "SecLookup Threat Intel" reference = "maper.info" strings: $url = "maper.info" wide ascii $f1 = "api_updater.exe" wide ascii $f2 = "proxifier.exe" wide ascii $f3 = "Proxifier" wide ascii $tmp = /Proxifier.{1,10}\.tmp/ wide ascii condition: uint16(0) == 0x5A4D and ($url or ($f1 and $f2) or $tmp) } ``` ## Recommendations To mitigate the risk of ClipBanker and similar trojanized software campaigns, SecLookup recommends the following actions: 1. **Software Vetting:** Always download software from official, verified vendor websites rather than third-party GitHub repositories or unofficial mirrors. 2. **Monitor Defender Exclusions:** Regularly audit Microsoft Defender exclusion lists. Malicious additions to `-ExclusionExtension` or `-ExclusionPath` are high-fidelity indicators of compromise. 3. **Endpoint Detection and Response (EDR):** Deploy EDR solutions capable of detecting in-memory PowerShell execution (e.g., via `PSObject` or Reflection) and process injection into unusual stubs in the `%TEMP%` directory. 4. **Clipboard Monitoring:** For high-value workstations (e.g., those used for crypto transactions), consider security tools that alert on unauthorized clipboard modifications. 5. **Block Malicious Infrastructure:** Ensure your DNS and firewall solutions are updated with the IOCs provided above, specifically blocking `maper.info` and known "raw paste" service URLs used for C2. ## References * [The long road to your crypto: ClipBanker and its marathon infection chain](https://securelist.com/clipbanker-malware-distributed-via-trojanized-proxifier/119341/) by Oleg Kupreev, Securelist (Kaspersky GReAT)