animateclipper | 67d1aeae3da2eea072c9f6bec6693a26c797ca372a2c6f2e58b804d9a063f7f8

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
𝐒𝐄𝐓𝐔𝐏.exe
Size 1.1MB
Sample260804-yhr23adj5w
SHA256 67d1aeae3da2eea072c9f6bec6693a26c797ca372a2c6f2e58b804d9a063f7f8
MD5 eb310863c1235677d04d6038d03a917c
SHA1 98037984692f5f92651b7009ee0573900ba6a654
SHA512 d422225c6413933825d23e6347691d5ee222bb91b11f7977da75e3d78bb1439ee19dfbad82a01ae0a8544b30f97a2785f7632b738f924e99429ec42275321498
SSDEEP 24576:dkrxVZpgaFsx7MmMKsmsCMmM7mMCsmswVMmMCsmsasmsCMmMKsmsCMmMigsaVCsx:RzskS
TLSH
T185359E26B26C41E4D166D1BC89960506F7F37C4613329FDB47A0AE9A1F17AF0AE7F210
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper discovery execution animateclipper spyware stealer

Malware Config

Extracted

Family

animateclipper

bsc.blockrazor.xyz

Mutex

update-S-2-5-26-24247216-2331352693-3112950123

Wallets

0x8eb9a56afbe6d79aa90fba9c8f6af7321490c786
1B7GRvB1WMZYNCz5FdXocHicUyp8pj1FvX
1Ht6TLmpMc3xhN5euPZo5ecC4RJtfJrJu8
3BJquhr9pnQhMo1RCPJHsKnrUKgs8StkKT
8SjFSqSJ6DYAcBJrNGN76hEhcij5vtyJK5G819CvV7Fm
DKSfYvjh8hZwR6q3nNvtKYrgK892groxfd
LNMjkFCv1R2T5vwvuXmUFHHeJLmYAdgzX3
TSw3kk2GCyUUsGnvR2ZHSNoEaWkhfkGE1J
UQCYdXT16Xxzr1qCSVxxntce0-UYXmcqJ_aodkoq39Fv2E6f
XdJHMeC11gmiA5rpnJhu9cTax61q333o1g
bc1qw8wnedcwur3e4pq6qpdrquxpd09a5lss5glf77
cosmos1pgtakf0xe8ehexdgqz9c3lj436wyyg772qec8m
ltc1qs9whv7632zyrr828n7e6g5jqtq0ykgklvfm80u
qphwpg3ja0awpjt2vrfy5mxmk3h24vrswg9ll9umkm
rKaNCgLvMEXxNzMxj2F7FYi1AdRrTo6Nhu

Attributes

auth_token
824c6b4d-4f01-4e22-a500-c7d239e10480
contract
0x77c08D8A4Eab268fd5728ae8fE41b1FDE52967dF
headers
Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480

Content-Type: application/x-www-form-urlencoded

Signatures

Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper

Detects AnimateClipper 4 IoCs

resource	yara_rule
behavioral2/memory/2964-33-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/2964-45-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/2964-44-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper
behavioral2/memory/2964-43-0x0000000140000000-0x0000000140040000-memory.dmp	family_animateclipper

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1696	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
15	4284	𝐒𝐄𝐓𝐔𝐏.exe

Executes dropped EXE 1 IoCs

pid	Process
2964	2026-08-04 20.49.02.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 6052	4284	𝐒𝐄𝐓𝐔𝐏.exe	90
PID 4284 set thread context of 3568	4284	𝐒𝐄𝐓𝐔𝐏.exe	94

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
4284	𝐒𝐄𝐓𝐔𝐏.exe
1696	powershell.exe
1696	powershell.exe
1696	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 6052	4284	𝐒𝐄𝐓𝐔𝐏.exe	90
PID 4284 wrote to memory of 6052	4284	𝐒𝐄𝐓𝐔𝐏.exe	90
PID 4284 wrote to memory of 6052	4284	𝐒𝐄𝐓𝐔𝐏.exe	90
PID 4284 wrote to memory of 3568	4284	𝐒𝐄𝐓𝐔𝐏.exe	94
PID 4284 wrote to memory of 3568	4284	𝐒𝐄𝐓𝐔𝐏.exe	94
PID 4284 wrote to memory of 3568	4284	𝐒𝐄𝐓𝐔𝐏.exe	94
PID 4284 wrote to memory of 1696	4284	𝐒𝐄𝐓𝐔𝐏.exe	100
PID 4284 wrote to memory of 2964	4284	𝐒𝐄𝐓𝐔𝐏.exe	102

C:\Users\Admin\AppData\Local\Temp\𝐒𝐄𝐓𝐔𝐏.exe
"C:\Users\Admin\AppData\Local\Temp\𝐒𝐄𝐓𝐔𝐏.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "& { try { Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\2026-08-04 20.47.35\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\2026-08-04 20.47.35\result.zip' -Force -ErrorAction Stop; exit 0 } catch { exit 1 } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Users\Admin\AppData\Local\PeerDistRepub\2026-08-04 20.49.02\2026-08-04 20.49.02.exe
  "C:\Users\Admin\AppData\Local\PeerDistRepub\2026-08-04 20.49.02\2026-08-04 20.49.02.exe"
  2⤵
  - Executes dropped EXE
  PID:2964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4148

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemInfo.txt

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\2026-08-04 20.47.35\SystemInfo.txt
Size 481B
SHA256 34921fc29e09c7fb9ed6e70d24b84dd15fa40b2c80ae2e0c68cd3b2bd616e207
MD5 1fe47fb3e42dece6113757f9859b808a
SHA1 897e30bca890880e476f27cc0b131a8b4e7babe8
SHA512 c99df2cb26454b44a083322954895ecd4778cc6b148bc8f65067acc278119d0cefcde93e79445064a8bcd4ba9b0fcd3f20b55be4784d5be12701a066f902ab45
TLSH
T104F0DC248904E014187927F551A0AB0137E18D8AE27BC42EFAEEE2596BC3B0893F9634
MD5 SHA1 SHA512 TLSH

Submit Download

V10.txt

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\2026-08-04 20.47.35\V10.txt
Size 113B
SHA256 ccf98b220a40c2474530394bb090465e3948a5ea28c1416fd373b3e738c4bf9b
MD5 9578e8f8b981bd8b721fe00246a40218
SHA1 4a5f8899625313ee8f004ba84b6160de1d32b326
SHA512 d7c8baa8e03d98b6b736c6dd4957da6888a49dcaa033d3b12c0376ce96967c1b3f1349821ce6ba51c4198959353e9dca96b17f293fc497313859c05e3f86ca0c
TLSH
T15AB022EFEC33E20F000B00220C03F0000E020028BA22003F3C2FA0A2EBCA0A3008BEC0
MD5 SHA1 SHA512 TLSH

Submit Download

V20.txt

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\2026-08-04 20.47.35\V20.txt
Size 113B
SHA256 7ee3434ba86d57f361ed5aeb072b94921e5e43b860d254db506a424c3dc387e8
MD5 64c0120399933377bf94d76c69d78c22
SHA1 3f104e1c48ac15d6e077bf18ace08d27666a94f4
SHA512 c71f6aeeda21c1f6c196ed636ce5b86ad8dfe9fa963cd1127edf1695937d12143491c46885f9fddb23c2b018e08049896f0399699d73eda37135014e663d7ad0
TLSH
T1DBB022A2E2880C2A282CF0000C8030A3EC033E08CA0CA3223C233002FE03803832C288
MD5 SHA1 SHA512 TLSH

Submit Download

monitor_0_1785872855629.png

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\2026-08-04 20.47.35\monitor_0_1785872855629.png
Size 540KB
SHA256 264a3004073e252d826436eed30c33282803d253a0f130a679fb8cb914685124
MD5 40cc31687fb1fd323782cfb7efd42906
SHA1 13efbc0d467fd9dcbfd1a9240b5e4910cbbdd8d7
SHA512 81a49521a278fd23d47f6d52225a615566c1b964a24f0ae600cae0638cc1b9101b9aaf36f96e0b7ba682a9d5abbc384177cdb1b528ae9ecb6ab88393f595f59e
SSDEEP 12288:QbLQF4jxUBt6pYO/4CaC9A2nXdo5b5OFDAOvEBbDtQyr94D4eMFtCWEj:QbIcUBcpYrj6bdo5b5sDAOAtxrE4zCWO
TLSH
T106C423AC71B92E4C8CE5247FFCE81ADE466452238A6C4576CE3102611D18FEEB750EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

result.zip

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\2026-08-04 20.47.35\result.zip
Size 559KB
SHA256 1a016bb25ecdd0087e3168024d32a00af57d188c9d4ef57fe6d3a7e93581aad5
MD5 eab023f6f396a8b5673ed2f03ef3249a
SHA1 bb4efafa7903181102d08c6735e08abcaeb864d6
SHA512 523981ef9ba6e3d99fe38191a5987f4925aff65aa3cbd11845435c0133535f5841fd4d21bc6aff6973d74d6563b87316a99d90e8f059c24f773dc0a70f295e03
SSDEEP 12288:jYb3mrGZ/1aNj4NWFfcW8NpK32SVWNdadmi4GW4yTKO2pbLR:jYbXF+3jWkAi47/KhLR
TLSH
T134C423043A9FEF4EECE346B5A312A15E3DCCB04807B560643A46C4E617BF9760B6E15B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-04 20.49.02.exe

Path C:\Users\Admin\AppData\Local\PeerDistRepub\2026-08-04 20.49.02\2026-08-04 20.49.02.exe
Size 669KB
SHA256 9bb943340f1b6bf6cff15334ab9b0ab32740455f50f76a779f1735445cb521ae
MD5 b31093312532079c8278c6d5c1a1f2e2
SHA1 842b41dd249f589becdb81b520500390f62a8b5e
SHA512 7bee052bf5a97d4085e08f3917750ec05e346cf15b78b66e711dc71ccc999eccf4c8e5b056664fbfab4e803a503fdf8e43b14dee72fec1208b854bea4f36bd7b
SSDEEP 12288:1tCn2prJlN/MgqQHy/vBzsk5pmKQpxxO1T65HNwkfJfVnjKho0TV3xjIRDAtIKZp:1tC2prJlN/MgqQHy/vBzsk5pmKQpxxOf
TLSH
T1DCE40E8F4A7444D1DC2572B290DABA0EDA14ACAEDDAD51FE1E562F18E93CC09CD0F139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-16-0x00000285A1160000-0x00000285A116A000-memory.dmp

Download

memory/1696-15-0x00000285A1180000-0x00000285A1192000-memory.dmp

Download

memory/1696-13-0x00000285A10A0000-0x00000285A1152000-memory.dmp

Download

memory/1696-12-0x00000285A1080000-0x00000285A109E000-memory.dmp

Download

memory/1696-9-0x0000028588D90000-0x0000028588DB2000-memory.dmp

Download

memory/1696-14-0x0000028588E10000-0x0000028588E1A000-memory.dmp

Download

memory/2964-33-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2964-45-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2964-44-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2964-43-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/3568-3-0x0000019A04740000-0x0000019A04745000-memory.dmp

Download

memory/6052-2-0x00000162F04C0000-0x00000162F04C5000-memory.dmp

Download