animateclipper | bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.exe
Size 1.1MB
Sample260803-pg7axsyxcx
SHA256 bc9165c426258d33799107d41a1e692504d7e69e02762475ab3b8cbcd19d5d40
MD5 bf50325f1dbd215e1c734c00b251789d
SHA1 4b988defc8a7a8d8b86ef2d79ff1cdd6b31b7d34
SHA512 d35023b758690b6c43fb46fbe3ed262f90578f040d78f1ffb7be9af5d3fc49de403ebb34654c7a023f6e01d71b9dc402f693fd3a999d7f916872d7ad180463d8
SSDEEP 24576:lC0Pf7dNvVC2cuWnd/ewT96mCTucMVvu8QmCgFqk:lvPfanHT95wpm9
TLSH
T18135BF15A3E401B8E92BC278CB9A4233E7B274551774AACF0759EA553F33AD06F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper animateclipper stealer

Malware Config

Extracted

Family

animateclipper

bsc.blockrazor.xyz

Mutex

update-S-2-5-26-24247216-2331352693-3112950123

Wallets

0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f
1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq
3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ
4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc
DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy
JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ
LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6
MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj
RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj
TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ
UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd
XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG
bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0
bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2
cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr
ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz
qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y
rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z

Attributes

auth_token
91c5546b-f7c7-40aa-833d-515aa2cb49f6
contract
0x6936edc505501EBB2F202C985a021a06f1c10C9E
headers
Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6

Content-Type: application/x-www-form-urlencoded

Signatures

Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper

Detects AnimateClipper 1 IoCs

resource	yara_rule
behavioral2/memory/4472-2-0x00007FF6577C0000-0x00007FF657800000-memory.dmp	family_animateclipper

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3704 set thread context of 4472	3704	3.exe	88

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4472	3704	3.exe	88
PID 3704 wrote to memory of 4472	3704	3.exe	88
PID 3704 wrote to memory of 4472	3704	3.exe	88

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4472-2-0x00007FF6577C0000-0x00007FF657800000-memory.dmp

Download

memory/4472-0-0x000001D9ACF80000-0x000001D9ACF81000-memory.dmp