xvclipper | 9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e.zip
Size 2.7MB
Sample260905-tk35wsvwdy
SHA256 031053872b92407f887d398aecc9e88d01feeb5c160ccc3ee805b038fe48a445
MD5 b822d82b155e60642dfe62e9fc3ecd2b
SHA1 ec7171432f633cb631cebf106c23e7b4e483f536
SHA512 11eb3648de3c92fd25509cca31384ea748a9a4d9d7044d07c16e74b8b49e2f0c8c3e02232431d96efe2bb4db2253617188fd9b759cda462ce5902cf1be507c8c
SSDEEP 49152:OSJ2joZAcKV+yOzKjCM2MLvb4bykShfE2D7C7G1Drl+IqZ0k92zu6fhqLO:OSJ2EC3lWML/kEM2D7mqr8I+0k92zuAL
TLSH
T1DBD53323734A25F472B4B74097C8E4FDAFC2B0D0949AFDDA82D39D52C12A34638F5566
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e

File Explorer

9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e.zip

.zip 2.7MB
9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e

.exe 6.5MB

9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e.zip

SHA256 031053872b92407f887d398aecc9e88d01feeb5c160ccc3ee805b038fe48a445
MD5 b822d82b155e60642dfe62e9fc3ecd2b
SHA1 ec7171432f633cb631cebf106c23e7b4e483f536
SHA512 11eb3648de3c92fd25509cca31384ea748a9a4d9d7044d07c16e74b8b49e2f0c8c3e02232431d96efe2bb4db2253617188fd9b759cda462ce5902cf1be507c8c
SSDEEP 49152:OSJ2joZAcKV+yOzKjCM2MLvb4bykShfE2D7C7G1Drl+IqZ0k92zu6fhqLO:OSJ2EC3lWML/kEM2D7mqr8I+0k92zuAL
TLSH
T1DBD53323734A25F472B4B74097C8E4FDAFC2B0D0949AFDDA82D39D52C12A34638F5566
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e
MD5 0afc34ae53a24837963e5256dd8864fb
SHA1 de98d3e350cbf6bf4d9b99f7acf6c55584881376
SHA512 6983c496fb0ed826d7e1a88287492523fb9966a0a874864edd02f5f90a4a1af075bf94b37377a07e4f8ffb170f65936cef4a4e08726163fb1c73d3baef1966b7
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8B:T6BJUoROZfIA8Xf8xumvBh8huTEEmslj
TLSH
T1C4665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e.zip

9c492eca1a304b5f34890de7516ba8c9486c978c0a746b0343a88f3c53c10e4e

kernel32

generic