Extracted

• • Target
    Setup.exe
  • Size 2.3MB
  • SHA256 bbad922cd7ad33f2592c001d0956491d873ed2270766e0f0f81c8adc076c8307
  • MD5 c24fe5ae59d1369775d162697d52e370
  • SHA1 dd2387171456dcf0a516d546b9afcddead39868b
  • SHA512 bafb65f8fd6ae7335b5e189abb419de1cbc427f4a6c20cb6e4c70f876051ce02ed119ba7e3da6afbe47de38c93a43017ea9df6847c95c8ccff909fa252db0f6c
  • SSDEEP 49152:bUHBjeYsjkZ6oOW/iXDML3GjoO/Qfidly7ZcK8I:bGByxW/iXIOQfiuZcK
  • TLSH
    T142B5234342D8A028E1766736CDB2608712707D9B6BB8A5CF3B94BA0A3E73DD1D539707
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  clipperdiscoveryexecutionanimateclipperspywarestealer

  • Detects AnimateClipper

  • Family: AnimateClipper,ZigClipper

    AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.

    clipperstealeranimateclipper

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4