xvclipper | 1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4.zip
Size 2.7MB
Sample260905-tkpmhavwct
SHA256 1d303099bad493bf7bc9509b8ebba0c507f00d7cdd37a883153611c42865a129
MD5 4dcd1d294948b1aac90915990d1648e2
SHA1 ab1e9e17418cf2924caa4450bcada116b2f7054a
SHA512 34c567cba83b26dd677a95e20672b05a1823be147270c2d72c57a4d605f6ea52d302085537b446c9e6c90da3b60f7276409cf4b23bec3a2a6e79d72c8af7532c
SSDEEP 49152:aDVwdEgL9mDq3vXUlQOXmIV0x9G+wsYtMlvvWk9ca1AydFPxd:xEgpmDQvXUMmXMlGmcqrXxd
TLSH
T122D53306B623A3EEA9C6ACC3BC3F46D594D9077819F23B5989DC401F8C751A6FB590D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4

File Explorer

1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4.zip

.zip 2.7MB
1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4

.exe 6.5MB

1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4.zip

SHA256 1d303099bad493bf7bc9509b8ebba0c507f00d7cdd37a883153611c42865a129
MD5 4dcd1d294948b1aac90915990d1648e2
SHA1 ab1e9e17418cf2924caa4450bcada116b2f7054a
SHA512 34c567cba83b26dd677a95e20672b05a1823be147270c2d72c57a4d605f6ea52d302085537b446c9e6c90da3b60f7276409cf4b23bec3a2a6e79d72c8af7532c
SSDEEP 49152:aDVwdEgL9mDq3vXUlQOXmIV0x9G+wsYtMlvvWk9ca1AydFPxd:xEgpmDQvXUMmXMlGmcqrXxd
TLSH
T122D53306B623A3EEA9C6ACC3BC3F46D594D9077819F23B5989DC401F8C751A6FB590D0
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4
MD5 01236c87a22bc5579f47793035e023d1
SHA1 7387b0d336eb01d2930abb2a45ed78927c65cd08
SHA512 cebb5e903ddd195fcd7c330d5321fedf8035af2faaf3c2bd52f439bdba52a12ef9f0a1c34adc7fe30d3e12d32fd916eb8a3f48e37f1e142f9f40be577abfe11b
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8o:T6BJUoROZfIA8Xf8xumvBh8huTEEmx
TLSH
T16B665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4.zip

1e3925875c6f9262c6305845f9896ed53ce0746be6d7526eb4e9bd19c40094e4

kernel32

generic