xvclipper | 11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b.zip
Size 2.7MB
Sample260917-rn92hasbmd
SHA256 79fd4363e26ffefbbb0dc1d923d09928724b07ec0d7ee6de6ed51496370665b4
MD5 ddec32b1bc0357c91aae4b6e78d2cfac
SHA1 27f40eaa3c1fc4ca4b296c2e0ada0b0bd51f7ad6
SHA512 5d36bfbbd1a433d6b11e1c0ac386a7873b119db8dd7139917137ab2bf3ad590df5744cc5345b14ead5154da6f2445ee0af67c9bdafd63439d3a5a43b5e6789e7
SSDEEP 49152:yHKzRfj6AwNb611w/NdDkXHaOzFTbGfVvOHTuxtiXdhU6G9gHHtiLGxmlOLdJa22:w0ffCb8wFdDkqOzFTatvITnzUn8H4LGG
TLSH
T1E5D533DEE5980B24B4D5B45E37F11A72F02E1908F7A881A75B814429A7BDDC434A3FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b

File Explorer

11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b.zip

.zip 2.7MB
11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b

.exe 6.5MB

11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b.zip

SHA256 79fd4363e26ffefbbb0dc1d923d09928724b07ec0d7ee6de6ed51496370665b4
MD5 ddec32b1bc0357c91aae4b6e78d2cfac
SHA1 27f40eaa3c1fc4ca4b296c2e0ada0b0bd51f7ad6
SHA512 5d36bfbbd1a433d6b11e1c0ac386a7873b119db8dd7139917137ab2bf3ad590df5744cc5345b14ead5154da6f2445ee0af67c9bdafd63439d3a5a43b5e6789e7
SSDEEP 49152:yHKzRfj6AwNb611w/NdDkXHaOzFTbGfVvOHTuxtiXdhU6G9gHHtiLGxmlOLdJa22:w0ffCb8wFdDkqOzFTatvITnzUn8H4LGG
TLSH
T1E5D533DEE5980B24B4D5B45E37F11A72F02E1908F7A881A75B814429A7BDDC434A3FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b
MD5 3d1ebce06ec005e2e832c1bd9893bf16
SHA1 b33986abdbba0064a7510b4d45c581783eed256c
SHA512 9bdd90ec83b57f47fe9762f04872ab854699ba378f7443b71ee0d965dfaba0ba5f5014163f9e43d060199ebd5a97c7248be655872f28140221ea06c3716f2015
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8u:T6BJUoROZfIA8Xf8xumvBh8huTEEmq2
TLSH
T1A6665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b.zip

11fe41b72c1943d7bdeb2caba278b4b479fd851e9634cb193ce8d8d62334561b

kernel32

generic