xvclipper | d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c.zip
Size 2.7MB
Sample260916-wmshaabh95
SHA256 9459e9eea19ca5913c08d2b55b74d1ce50e3d0baa29cbd7ced76d2d6da55860d
MD5 ae713c08e8645a37bf8f410388aa1b39
SHA1 4e6dc54aa1e73dd16ed2332b56a30e09bb5fc3d1
SHA512 c63a3d166dc18c04b21eea9013604e260efdc5d9bfa6515ef71b06c4fc5237b2c15c2d658a7d64661a2bf85d37e17827d1d921f7bc07f65f5daba29df418c45b
SSDEEP 49152:zXs6Wz41EutibvZJcvuCcG7XX2xMpZitabYNzms4XcYUfMJv7nYWwsG/OoJk1nb/:AT/CiLZJcbcG7n2xcZitKGMLUUJv7YWP
TLSH
T1F1D53357825D794A0456C5EB7EEE0DCC5A06AD8ED5B73CE09D08020997BF2E7ECB84C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c

File Explorer

d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c.zip

.zip 2.7MB
d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c

.exe 6.5MB

d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c.zip

SHA256 9459e9eea19ca5913c08d2b55b74d1ce50e3d0baa29cbd7ced76d2d6da55860d
MD5 ae713c08e8645a37bf8f410388aa1b39
SHA1 4e6dc54aa1e73dd16ed2332b56a30e09bb5fc3d1
SHA512 c63a3d166dc18c04b21eea9013604e260efdc5d9bfa6515ef71b06c4fc5237b2c15c2d658a7d64661a2bf85d37e17827d1d921f7bc07f65f5daba29df418c45b
SSDEEP 49152:zXs6Wz41EutibvZJcvuCcG7XX2xMpZitabYNzms4XcYUfMJv7nYWwsG/OoJk1nb/:AT/CiLZJcbcG7n2xcZitKGMLUUJv7YWP
TLSH
T1F1D53357825D794A0456C5EB7EEE0DCC5A06AD8ED5B73CE09D08020997BF2E7ECB84C8
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c
MD5 2caa79743a45dcb6a648e831c0acf5e7
SHA1 183ec48176fda8588276ee8916d400121518a958
SHA512 475aedcd264c93fd5aee26b564f94368da435dd7f396f1ce5f46c18c12b493f00b3e2fde7d69ca87db1b5fe3929e10d1b0d37ab0d743cda89486adf2baa1a6fd
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8e:T6BJUoROZfIA8Xf8xumvBh8huTEEmp
TLSH
T157665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c.zip

d2fa162bcb7c2f6b29b60dc3c8e9c24f20c62a000724d4d251bcb7cbf1075a3c

kernel32

generic