xvclipper | 61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049.zip
Size 2.7MB
Sample260916-tcvtjsseqc
SHA256 8017266d461cac87c226310841f7e1494adbd669be9d3dba99563210edd989fc
MD5 2226f13fc7d5999ecc2c02731ff53977
SHA1 096f32905d4065d6db86cedddda1b0583c87295c
SHA512 e62b6c608993f06b35455add28f71ad1b96ed2e856e0e117d842c5ea23a04d81599857cac1db3eb508c97108de0ba25f4323194df9542b059e3a98a71f242ba5
SSDEEP 49152:SPAiJxYdkg2qZkm36CBvIibBmUTGPcTJqHu4pKB0Ixr15mBBJ89xS:f2+dkgZkmKC9IJQLTJqOSer1oB+zS
TLSH
T126D53355EB455AE4CFC86E5013F553BE4C08BCAFE5B92A2FD287A40212D0492AB4DDE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049

File Explorer

61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049.zip

.zip 2.7MB
61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049

.exe 6.5MB

61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049.zip

SHA256 8017266d461cac87c226310841f7e1494adbd669be9d3dba99563210edd989fc
MD5 2226f13fc7d5999ecc2c02731ff53977
SHA1 096f32905d4065d6db86cedddda1b0583c87295c
SHA512 e62b6c608993f06b35455add28f71ad1b96ed2e856e0e117d842c5ea23a04d81599857cac1db3eb508c97108de0ba25f4323194df9542b059e3a98a71f242ba5
SSDEEP 49152:SPAiJxYdkg2qZkm36CBvIibBmUTGPcTJqHu4pKB0Ixr15mBBJ89xS:f2+dkgZkmKC9IJQLTJqOSer1oB+zS
TLSH
T126D53355EB455AE4CFC86E5013F553BE4C08BCAFE5B92A2FD287A40212D0492AB4DDE3
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049
MD5 30850f0e85c5fd053d8bd7284d75e7f6
SHA1 77c7acc6c4679be61675d8702c0bf906e4538a4f
SHA512 69ad8f9b8ebf298c813d9af49ced7ada230675e395536a8b706a71b970f08597e9dc60784e296d7ea92b5cf4224b958dce9936af9099cfaa897d1d3b7f870651
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8B:T6BJUoROZfIA8Xf8xumvBh8huTEEmNi
TLSH
T18C665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049.zip

61dfa9c9b93838c8506ed01b4d36c0c8c385a9366c9827ff36dd306ec0dd7049

kernel32

generic