Extracted

• • Target
    𝐒𝐄𝐓𝐔𝐏.exe
  • Size 1.1MB
  • SHA256 67d1aeae3da2eea072c9f6bec6693a26c797ca372a2c6f2e58b804d9a063f7f8
  • MD5 eb310863c1235677d04d6038d03a917c
  • SHA1 98037984692f5f92651b7009ee0573900ba6a654
  • SHA512 d422225c6413933825d23e6347691d5ee222bb91b11f7977da75e3d78bb1439ee19dfbad82a01ae0a8544b30f97a2785f7632b738f924e99429ec42275321498
  • SSDEEP 24576:dkrxVZpgaFsx7MmMKsmsCMmM7mMCsmswVMmMCsmsasmsCMmMKsmsCMmMigsaVCsx:RzskS
  • TLSH
    T185359E26B26C41E4D166D1BC89960506F7F37C4613329FDB47A0AE9A1F17AF0AE7F210
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  clipperdiscoveryexecutionanimateclipperspywarestealer

  • Detects AnimateClipper

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2