How ClipBanker Trojan Executes Its Marathon Infection Chain: A Step-by-Step Analysis

Introduction

ClipBanker, a Trojan with an unusually long and intricate infection chain, begins its journey when a user searches for “Proxifier” on a web engine. The malware exploits the popularity of legitimate proxy software to trick victims into downloading a malicious installer. This guide dissects each stage of ClipBanker’s marathon infection process, from the initial lure to the final payload execution. Understanding these steps helps security professionals and curious users recognize the attack patterns and defend against similar threats.

What You Need

• Basic familiarity with Windows operating system and its security features (e.g., Microsoft Defender)
• Understanding of common malware analysis concepts (process injection, PowerShell scripts, scheduled tasks)
• Optional: A controlled sandbox environment to simulate the infection (for research purposes only)

Step 1: The Initial Lure – Searching for Proxifier

The infection chain starts when a user searches for “Proxifier” or “proxifier” on a popular search engine. The top result often points to a GitHub repository that hosts source code for a simple proxy service. However, the trap lies in the Releases section. There, an archive contains an executable file and a text document. The executable is a malicious wrapper bundled with the legitimate Proxifier installer, and the text file offers activation keys to add credibility.

Note: The GitHub repository itself appears legitimate, making it an effective decoy.

Step 2: Downloading the Malicious Archive

The victim downloads and extracts the archive, then runs the executable (the wrapper). This launches the first stage of the infection.

Step 3: Adding Microsoft Defender Exclusions (First Donor Process)

Once executed, the Trojan’s immediate goal is to disable Microsoft Defender from detecting subsequent malicious files. It does this through a multi-step process:

1. The wrapper creates a tiny stub file (about 1.5 KB) in the temporary directory, named “Proxifier<???>.tmp”. This stub does nothing on its own – it serves as a donor process for code injection.
2. A .NET application named api_updater.exe is injected into the stub. This application decrypts a PowerShell script using the PSObject class, which allows the script to run directly inside the current process without spawning a separate console window or PowerShell interpreter.
3. The PowerShell script adds exclusions to Microsoft Defender for all files with the .TMP extension and for the directory containing the wrapper executable.

Step 4: Deploying the Legitimate Proxifier Installer

With the exclusions in place, the trojanized wrapper extracts and launches the real Proxifier installer. This ensures the user sees a legitimate installation process, reducing suspicion while the malware continues its background activities.

Step 5: Second Donor Process and Injection Chain

Simultaneously with the installer launch, the Trojan creates another donor process. Into this process, it injects a module named proxifierupdater.exe. This module acts as a secondary injector:

• It launches the system utility conhost.exe (Console Window Host).
• It injects another .NET application (internally named bin.exe) into conhost.exe.
• This injected application runs another PowerShell script using the same PSObject injection technique.

Step 6: Final Payload – Persistent Execution Setup

The second PowerShell script is obfuscated and partially encoded, but it performs four distinct actions:

1. Adds powershell.exe and conhost.exe to Microsoft Defender exclusions, ensuring further malicious activity goes undetected.
2. Creates a registry key at HKLM\SOFTWARE\System::Config and stores another Base64-encoded PowerShell script as its value.
3. Configures a scheduled task that launches PowerShell with a command to read the contents of that registry key, decode the Base64 script, and execute it.
4. Transfers control to the decoded script, which likely executes the final payload (e.g., crypto-clipping or data theft).

Conclusion and Tips

The ClipBanker infection chain demonstrates how malware leverages legitimate tools (Proxifier, GitHub) and advanced techniques (donor processes, PSObject injection, scheduled tasks) to achieve persistence and evade detection. Key takeaways for defense:

• Verify download sources: Avoid downloading executables from unknown GitHub releases.
• Monitor for unusual process creations: Look for stub files in Temp, multiple injectors, and suspicious PowerShell activity.
• Audit scheduled tasks and registry keys: Check for unexpected tasks and keys like HKLM\SOFTWARE\System::Config.
• Disable PSObject abuse: Restrict PowerShell execution policies and consider application whitelisting.
• Keep Defender enabled and updated: Even with exclusions, modern AV can detect anomalies if properly configured.