xvclipper | 394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5.zip
Size 2.7MB
Sample260912-tpazxaed49
SHA256 f4acabd9206764af211ff1c490fdf0a14ee7169637ddb786f2127573c280e104
MD5 34ca9f4ca8a80b6b379b5aae2e989a77
SHA1 64adb479756fdaff4ec0f4b8a56fcaae7b47947a
SHA512 817b916a12964c478474a60d6be643d47106a64de213ad12f97ae21f3ca8579eba8098f76ad07a247054bee0f3c1766111d8b4c97c65685930f429894fbbb086
SSDEEP 49152:LsvJojg6RS6l0oGs6MxO/lRTGUVnALwCCbp+FC4T6FNwpU6GuoB2a2pDzeocrGh:ohose5GVnpFnAqbp+FCW6FKp2Q+zrS
TLSH
T1C5D5336C11EA0AB76D5EC0859FBD9DD8337E4A8CFC6422F652A003EEC2215F69197371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5

File Explorer

394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5.zip

.zip 2.7MB
394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5

.exe 6.5MB

394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5.zip

SHA256 f4acabd9206764af211ff1c490fdf0a14ee7169637ddb786f2127573c280e104
MD5 34ca9f4ca8a80b6b379b5aae2e989a77
SHA1 64adb479756fdaff4ec0f4b8a56fcaae7b47947a
SHA512 817b916a12964c478474a60d6be643d47106a64de213ad12f97ae21f3ca8579eba8098f76ad07a247054bee0f3c1766111d8b4c97c65685930f429894fbbb086
SSDEEP 49152:LsvJojg6RS6l0oGs6MxO/lRTGUVnALwCCbp+FC4T6FNwpU6GuoB2a2pDzeocrGh:ohose5GVnpFnAqbp+FCW6FKp2Q+zrS
TLSH
T1C5D5336C11EA0AB76D5EC0859FBD9DD8337E4A8CFC6422F652A003EEC2215F69197371
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5
MD5 193c7d20d4c66dff36ecad7cabe9c09a
SHA1 ad55d78e10b62be11edd8e19a72e505d43c8cca6
SHA512 1b4993556ef3d3ad2ae14939ce3a5f3ff412697a836ad0a7cae27d37d076e4112401ee77ef75eae5071b9f62ade2b2f6f3b0a8c6f24c3ec080f3f69d7b3b4c4b
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8b:T6BJUoROZfIA8Xf8xumvBh8huTEEmOVD
TLSH
T190665C13EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5.zip

394bf5da658ca7b1648e0f086b5fd77a5823a5749f3af29da625af47b336bcc5

kernel32

generic