Fake Proxifier ClipBanker - GitHub Supply Chain
Detects the full infection chain of a trojanized Proxifier installer hosted on GitHub (lukecodix/Proxifier releases) distributing ClipBanker RAT. Active since early 2025 with 2,000+ confirmed victims (India/Vietnam focus). The malicious wrapper adds Defender exclusions for TMP/powershell/conhost, creates a ~1.5KB stub (Proxifier*.tmp) as a donor process, injects api_updater.exe and proxifierupdater.exe, then hollows into conhost.exe and fontdrvhost.exe to deliver a fileless C++ ClipBanker payload that replaces crypto wallet addresses across 26+ blockchains (BTC, ETH, SOL, XRP, DOGE, LTC, XMR, ADA, BNB, etc.). Multi-stage payload retrieved from pastebin, snippet.host, chiaselinks.com, rlim.com, paste.kealper.com, and secondary GitHub/Gitea repos. Persistence via HKLM\SOFTWARE\System::Config (Base64 PowerShell) + scheduled task. 12 queries covering known hashes, trojanized binary names, Defender exclusion abuse, registry persistence, schtask-to-PowerShell-to-registry chain, process hollowing into OS binaries, C2/payload domains, Pastebin/Gist exact-path IOC hits, fontdrvhost/conhost outbound anomaly, Proxifier*.tmp stub detection, GitHub-release-to-execution correlation, and full kill-chain correlation.
Microsoft Sentinel (KQL)
