xvclipper | 31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b.zip
Size 2.7MB
Sample260916-xrdelach49
SHA256 c8c5873506fec63d30645810a59c6b8fac7dc3d538265d0a1b98001161292e43
MD5 cb250dafd777befe1709869579c3cbd0
SHA1 5f8e48a5ee018a290f5b4d9cefa095db5ce18340
SHA512 cf76e50b7f3e02d634454424ef2e4e853fe11907d498aea9c1d128c3b78ad6fa9857923695abb77446fb1ea98e172d3de6b08425b8675e26aa75bb7d0c3828b8
SSDEEP 49152:+KFjOmjDvIaWj2DPPp96HZzYBHn717+i8FfWsztMAbpVLLdtVMD/ejuVrL/lQ:+KFjOdaWqDPB961YBH7x+iBszRzmDGj1
TLSH
T1E3D533A882FB1BED00A1DF35731644E2B40757095E4205BE18AF9F9F4A53C63E9CA2DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b

File Explorer

31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b.zip

.zip 2.7MB
31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b

.exe 6.5MB

31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b.zip

SHA256 c8c5873506fec63d30645810a59c6b8fac7dc3d538265d0a1b98001161292e43
MD5 cb250dafd777befe1709869579c3cbd0
SHA1 5f8e48a5ee018a290f5b4d9cefa095db5ce18340
SHA512 cf76e50b7f3e02d634454424ef2e4e853fe11907d498aea9c1d128c3b78ad6fa9857923695abb77446fb1ea98e172d3de6b08425b8675e26aa75bb7d0c3828b8
SSDEEP 49152:+KFjOmjDvIaWj2DPPp96HZzYBHn717+i8FfWsztMAbpVLLdtVMD/ejuVrL/lQ:+KFjOdaWqDPB961YBH7x+iBszRzmDGj1
TLSH
T1E3D533A882FB1BED00A1DF35731644E2B40757095E4205BE18AF9F9F4A53C63E9CA2DD
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b
MD5 0b9aed4a020b5aba46376ff633d5e0f0
SHA1 1cfaf2472211791d56b750e8ea4976aacaad6bdb
SHA512 b26571fc406009884fd60c8833f7d954a384742e9676036deb473c7fbe5fbd272cc6c3c3769dbe4cef7b2ced299b68d7d86bad0a8774ab97afd2a5af9681be1c
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8n:T6BJUoROZfIA8Xf8xumvBh8huTEEmK
TLSH
T108665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b.zip

31d42f1ae331fdee24df00bdf0650c8ab63f55b91ed4dd1909141d14b6a9b64b

kernel32

generic