xvclipper | 44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0.zip
Size 2.7MB
Sample260916-wl692sdr9v
SHA256 44ebfbbca454f1a06e6176e78b6e0a2a61d334e42166e40d0789e29848ca7841
MD5 c593be43e53fd1104af5ceb5ded87657
SHA1 3fe1ab9548e9f7b14c72af3c256c823c20871ff0
SHA512 2e6afff49b9cd286ea01be64a313ab18f9b2d9c34ebd803f50385f2676afbfaf01abdca9bff62c2fdc1e327813ffa323e3530e357c98ce41c981e31b9cc7bf80
SSDEEP 49152:XuyAvGTrFsRH1+ikiWmU0dm4irTQLhlnJx1GdXjUAJotPXclrGDdWIV2e/imh9/J:XuyAesV+VKEr2U1H4MlryF2oi+/RO3i
TLSH
T170D533F97EA7ACB9B7DC00609060EBE0F51C11D66C643892683744A39A6B173DCFF295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0

File Explorer

44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0.zip

.zip 2.7MB
44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0

.exe 6.5MB

44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0.zip

SHA256 44ebfbbca454f1a06e6176e78b6e0a2a61d334e42166e40d0789e29848ca7841
MD5 c593be43e53fd1104af5ceb5ded87657
SHA1 3fe1ab9548e9f7b14c72af3c256c823c20871ff0
SHA512 2e6afff49b9cd286ea01be64a313ab18f9b2d9c34ebd803f50385f2676afbfaf01abdca9bff62c2fdc1e327813ffa323e3530e357c98ce41c981e31b9cc7bf80
SSDEEP 49152:XuyAvGTrFsRH1+ikiWmU0dm4irTQLhlnJx1GdXjUAJotPXclrGDdWIV2e/imh9/J:XuyAesV+VKEr2U1H4MlryF2oi+/RO3i
TLSH
T170D533F97EA7ACB9B7DC00609060EBE0F51C11D66C643892683744A39A6B173DCFF295
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0
MD5 28e0bf1e41beabec25b5689b1ac393de
SHA1 c42d0ade54000284e9912833c8e122f4ddf3b691
SHA512 a1e4ce5c68275e4af354d68b07d64467e691a658b6b95585463effa36b5d9fda8db3cf090728015c83857ff4704ccfcfe6a685e7d9b1207a63a9d344939affe9
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8b:T6BJUoROZfIA8Xf8xumvBh8huTEEmO
TLSH
T1D1665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0.zip

44b97f30c8270e33497dab31adc3c638172b3872777f4bac8b4b4a31417ddec0

kernel32

generic