Extracted

• • Target
    fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab
  • Size 15.0MB
  • SHA256 fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab
  • MD5 44fb96375157c4149dca4758fc552999
  • SHA1 bf63a98db3c3b5c7921e12219af0bd002ed8abaf
  • SHA512 bba296353f5d56bb4ec3368bc7c7e0ef7f56c3b5fd20d385e9e6f120e200944df5b9c89cccf0cd954fe34b3a48e18681d5f8e06498cbf95fc5e8e4277abb5500
  • SSDEEP 24576:nY6TYOe2pP1y2DjTHcmQhPT+mP82giMYRu8XEtN5Fs9:nY6TYOEmQB+mmKzUtN09
  • TLSH
    T19CF67B15A3A356E8D2268177CA96CE32F7B578410760AACF0E54D3192E37AD47E3E313
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareclipperdefense_evasiondiscoveryanimateclipperpersistenceprivilege_escalationspywarestealertrojan

  • Detects AnimateClipper

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2