xvclipper | cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165.zip
Size 2.7MB
Sample260910-bqxaescl61
SHA256 f0527401cfbd241687f62a882ab43b434a25853fe465adda0ff69e440784e609
MD5 c03fb0d5e438871240870ea21b89375c
SHA1 ba0c2f363ce4ee3b9a0e40ab6670cffcfef70b25
SHA512 9dc9cf943102419018a2bfbbab335dcb09a009e38afc9d6736e88745c88e1b96cfe06b1f40c84e97da15c67a5458acc09a06410211770bd700aa4589767dc77d
SSDEEP 49152:+vTGBF/cLRtZTcQzo4Zp6+dMKGBcOpZt3Z8864UMp6lwzpfZv:+vyByLRtR5o46IrK/3LSLlad
TLSH
T11AD533096A7DE837A1370E2B2CBBDDF7941FA458C9F226446C9DF53B2025BFD8025468
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165

File Explorer

cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165.zip

.zip 2.7MB
cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165

.exe 6.5MB

cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165.zip

SHA256 f0527401cfbd241687f62a882ab43b434a25853fe465adda0ff69e440784e609
MD5 c03fb0d5e438871240870ea21b89375c
SHA1 ba0c2f363ce4ee3b9a0e40ab6670cffcfef70b25
SHA512 9dc9cf943102419018a2bfbbab335dcb09a009e38afc9d6736e88745c88e1b96cfe06b1f40c84e97da15c67a5458acc09a06410211770bd700aa4589767dc77d
SSDEEP 49152:+vTGBF/cLRtZTcQzo4Zp6+dMKGBcOpZt3Z8864UMp6lwzpfZv:+vyByLRtR5o46IrK/3LSLlad
TLSH
T11AD533096A7DE837A1370E2B2CBBDDF7941FA458C9F226446C9DF53B2025BFD8025468
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165
MD5 1dc4c2a242e04c42b0d9c8bf0b571be4
SHA1 220bc46aed6921bf96f7e50e5b0cd38f712488f2
SHA512 aa584169d98ef78c87a63576e533f385a69302e10dbacd791f3585de00f1751bbe073bee20ff01c456b02922908744a339883d6a228a8e99846cc0b67cae065c
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8Q:T6BJUoROZfIA8Xf8xumvBh8huTEEml
TLSH
T1D4665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165.zip

cff8cfa0b747fec8c52d2a7c1ca8c1818d3cb0e65e9aa51dce9cac4e4f03f165

kernel32

generic