Overview

overview

10

Static

static

3

1.exe

windows10-2004-x64

10

1.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1.exe
  • Size 30.1MB
  • Sample260803-tr9k9ashmd
  • SHA256 350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
animateclipperclipperpersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

  • animateclipper

C2

  • bsc.blockrazor.xyz

Mutex

  • update-S-2-5-26-24247216-2331352693-3112950123

Wallets

  • 0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f

  • 1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq

  • 3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ

  • 4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc

  • DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy

  • JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ

  • LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6

  • MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj

  • RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj

  • TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ

  • UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd

  • XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG

  • bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0

  • bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2

  • cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr

  • ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz

  • qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y

  • rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z

Attributes
  • auth_token

    91c5546b-f7c7-40aa-833d-515aa2cb49f6

  • contract

    0x6936edc505501EBB2F202C985a021a06f1c10C9E

  • headers

    Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6

    Content-Type: application/x-www-form-urlencoded

Targets

    • Target
      1.exe
    • Size 30.1MB
    • SHA256 350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    clipperanimateclipperpersistenceprivilege_escalationstealer

    • Detects AnimateClipper

    • Family: AnimateClipper,ZigClipper

      AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

      clipperstealeranimateclipper

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks