Overview

overview

10

Static

static

3

fdfd0b06cb...ab.exe

windows10-2004-x64

10

fdfd0b06cb...ab.exe

windows11-ltsc_2024-x64

10

Resubmissions

04/08/2026, 03:17

260804-ds37vsfl4s10

31/07/2026, 15:40

260731-s4g64axtfx10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 03:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe
  • Size 15.0MB
  • Sample260804-ds37vsfl4s
  • SHA256 fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
clipperanimateclipperpersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

  • animateclipper

C2

  • bsc.blockrazor.xyz

Mutex

  • update-S-2-5-26-24247216-2331352693-3112950123

Wallets

  • 0x8C9C95A830b7E7e86f2f12DB88e911499A6f695f

  • 1MuxHw4UUTsGtrYPa648xU822QEnCa7Hdq

  • 3CPNSyRZWCpe2RMZ8ZysPkjcJAQJErecTZ

  • 4x5U5QpXi4pNnDK9hpmZnV1gYNw78Ns1NWn5KtK5sksc

  • DBwmTibJfzs4nSnpDDsEjfmYqK3MUJDAfy

  • JZQCYTRBUGZR6TD6BLJXMB2ZYXI72CKFYPFGD5MP7K6FFV4XQ6QUFCRNEQ

  • LLSz2i1z6cjdqP34P6n78fCmpEoNAXFEu6

  • MWYxRmLZctVa7QcgiWemXGpvWc4drZBEPj

  • RSqNyaTeGjdbe8541bLG4UWU3jzx9oFGaj

  • TPtJCKJJDbLLPE7Mo9CZHw9RVWKV1hXcJJ

  • UQBEMPCcI_zn2UlBL-7r42fMHr6idU5ph9A_PbQP5lyRSCtd

  • XnbXJUXVRHXP6ejoieGzReP9GTFGvtkEjG

  • bc1phpyljll0vkjaukl33mmxfgcn030fe3rr3kt3lx9tvel7pap72rcsg5shm0

  • bc1qjmmnmjl54c8fzv8s4uvfsklgxe5hwe94kqaxh2

  • cosmos1tddarrjtgstsnutx9qpamsfjkpjjq52arpxklr

  • ltc1q3h79hhtvg0h66wyd9cjy20mzcwjdkcfj60cshz

  • qr6ca92nljwal2gct7wy2cjcnr7ksxmtwggt2ryz9y

  • rhFkjpX2kAUVSGGh9ZvGUYsyYMhSgUz14z

Attributes
  • auth_token

    91c5546b-f7c7-40aa-833d-515aa2cb49f6

  • contract

    0x6936edc505501EBB2F202C985a021a06f1c10C9E

  • headers

    Authorization: 91c5546b-f7c7-40aa-833d-515aa2cb49f6

    Content-Type: application/x-www-form-urlencoded

Signatures

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper
  • Detects AnimateClipper 1 IoCs
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe
    "C:\Users\Admin\AppData\Local\Temp\fdfd0b06cb31d68146dbb5ffb45b82ca1b59a7b4f62f917a990a9c3bd01654ab.exe"
    1⤵
    • Creates a file in the Startup directory
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
      2⤵
        PID:3372

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/3372-0-0x0000020151460000-0x0000020151461000-memory.dmp
          Download

          memory/3372-3-0x00007FF75B580000-0x00007FF75B5C0000-memory.dmp
          Download