Overview

overview

10

Static

static

3

file.exe

windows10-2004-x64

10

file.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file.exe
  • Size 30.1MB
  • Sample260802-e6qz5avclc
  • SHA256 350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
clipperanimateclipperpersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

  • animateclipper

C2

  • bsc.blockrazor.xyz

Mutex

  • update-S-2-5-26-24247216-2331352693-3112950123

Wallets

  • 0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f

  • 1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq

  • 3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ

  • 4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc

  • DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy

  • JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ

  • LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6

  • MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj

  • RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj

  • TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ

  • UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd

  • XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG

  • bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0

  • bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2

  • cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr

  • ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz

  • qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y

  • rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z

Attributes
  • auth_token

    91c5546b-f7c7-40aa-833d-515aa2cb49f6

  • contract

    0x6936edc505501EBB2F202C985a021a06f1c10C9E

  • headers

    Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6

    Content-Type: application/x-www-form-urlencoded

Signatures

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper
  • Detects AnimateClipper 1 IoCs
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Creates a file in the Startup directory
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      2⤵
        PID:5024

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/5024-0-0x00000204BDD90000-0x00000204BDD91000-memory.dmp
          Download

          memory/5024-2-0x00007FF6D1E70000-0x00007FF6D1EB0000-memory.dmp
          Download