MALICIOUS — libclash.so
MALICIOUS — libclash.so is a elf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the Maldoc family. 2 of 56 detection engines flagged it.
Identification
- SHA-256:
ceef96a35e129f18c180fea925a1a5d837b2d174f2ee48370e473b85084f1731 - SHA-1:
264f57b31a472292ee945db0b179d1020269c9c3 - MD5:
e016bb3488c262c0809201cfe2e3293b - ssdeep:
786432:e0gm1OkhhT7QhzM80BHd2+G73lYZUvsywIaIxLT36:Lgm1TKY - TLSH:
T1F97B7CE11959B64DE5E8E600B085A87C3AD305DFE76E42CC70FB9151A2FA33B818494F - Submitted as: libclash.so
- File type: elf · Size: 49569528 bytes
- Verdict: malicious (84/100) · Family: Maldoc
Detections (2 of 56 engines)
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: JPCERT/CC: JPCERT_LODEINFO
Why this verdict
The malicious score of 84/100 is the fusion of 3 weighted signals:
- YARA: JPCERT/CC flagged JPCERT_LODEINFO (rule
JPCERT_LODEINFO) - engine signal, weight 0.85, confidence 0.70 - YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70 - Embedded network infrastructure: https://dns.quad9.net/dns-queryhttps://freedns.controld.com/p0https://freedns.controld.com/p1https://freedns.controld.com/p2https://freedns.controld.com/p3tabwriter, https://go.dev/issue/66821, https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size - static signal, weight 0.35, confidence 0.60
Dynamic analysis
This sample is built for AArch64, which no sandbox guest in our fleet executes, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.
Embedded URLs
- https://dns.quad9.net/dns-queryhttps://freedns.controld.com/p0https://freedns.controld.com/p1https://freedns.controld.com/p2https://freedns.controld.com/p3tabwriter
- https://acme-v02.api.letsencrypt.org/directoryhttps://github.com/metacubex/tailscale/cap/sshTailscale
- https://github.com/metacubex/tailscale/cap/bind-to-interface-by-routereceived
- https://go.dev/issue/66821
- https://github.com/metacubex/quic-go/wiki/Logging
- https://github.com/MetaCubeX/mihomo/releases/download/Prerelease-Alpha/version.txttls
- https://github.com/metacubex/jls-quic-go/wiki/Logginglocalbackend
- https://go.dev/pkg/crypto/rsa#hdr-Minimum_key_size
- https://github.com/golang/protobuf/issues/1609
- https://github.com/tailscale/tailscale/issues/11508netstack
- https://github.com/metacubex/tailscale/s/ssh-selinuxmagicsock
- https://github.com/metacubex/tailscale/s/sshMozilla/5.0
- https://github.com/SagerNet/sing-tun/issues/25Mozilla/5.0
- https://tailscale.com/s/state-store-init-error
- https://github.com/metacubex/tailscale/s/locked-outMaps
- https://github.com/metacubex/tailscale/s/ssh-policy
- http://schemas.xmlsoap.org/soap/envelope/
- http://schemas.xmlsoap.org/soap/encoding/
- https://github.com/metacubex/tailscale/kb/1226/tailnet-lock#tailnet-lock-state00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899HTTP/1.1
- http://www.years
- http://.jpg
- http://www.interpretation
- https://www.recent
- http://www.wencodeURIComponent
- http://www.icon
Embedded domains
- ts.net
- ping.to
- big.int
- yaml.org
- tokengolang.org
- n.n.srv.nintendo.net
- sage-encryption.org
- dns.nextdns.io
- wgolang.org
- dns.controld.com
- setgoogle.golang.org
- dgithub.com
- vage-encryption.org
- dns.quad9.net
- freedns.controld.com
- protogithub.com
- keyage-encryption.org
- dns11.quad9.net
- dns10.quad9.net
- dns.mullvad.net
- wikimedia-dns.org
- www.gstatic.com
- www.w3.org
- cloudflare-dns.com
- tailscale.com
Embedded IP addresses
- 8.8.4.41
- 22.5.4.62
- 5.4.32.5
- 4.52.5.4
- 72.5.4.82
- 1.1.11.1
- 21.1.1.31
- 0.0.39.9
- 5.4.102.5
- 4.112.5.4
- 9.9.9.119
- 76.2.176.76
- 76.10.176.76
- 100.115.92.0
- 223.5.5.5
- 1.1.1.1
- 2.2.1.1
- 239.255.255.250
- 104.248.8.210
- 165.22.33.71
- 64.225.56.166
- 137.220.36.168
- 18.230.97.74
- 216.128.144.130
- 45.63.71.144
More Maldoc samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report