xvclipper | a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e.zip
Size 2.7MB
Sample260917-ss4kyssflc
SHA256 2acc8a406eea34c085a0495461558e7f465c05c13b063391bb23d10a240cc71d
MD5 70cd5963c33040fc1769df6cdda263f5
SHA1 beb0dec8179e086e2e766c235664a81cf1fcd635
SHA512 437dd87346083f645c066e7c6f4b09af6d7753852126b368ccd68b7747b36cceb92be689e66f300eac46d63187bbc1e9aefdef477783379f9983bd40b4abb910
SSDEEP 49152:GkIAAkKxpTk8h5IXPJQ2aENOVg4IFy76/0unXaupOZzcF8Kd9FDfD70fOsko+4hE:GkamQ25OVFcPnKuphJdP0fOQ+s7o
TLSH
T1E8D53303C43375A7C10BFCB3A774140FDA6A694A7925849CED8FDCF18C855A676F2A60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e

File Explorer

a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e.zip

.zip 2.7MB
a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e

.exe 6.5MB

a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e.zip

SHA256 2acc8a406eea34c085a0495461558e7f465c05c13b063391bb23d10a240cc71d
MD5 70cd5963c33040fc1769df6cdda263f5
SHA1 beb0dec8179e086e2e766c235664a81cf1fcd635
SHA512 437dd87346083f645c066e7c6f4b09af6d7753852126b368ccd68b7747b36cceb92be689e66f300eac46d63187bbc1e9aefdef477783379f9983bd40b4abb910
SSDEEP 49152:GkIAAkKxpTk8h5IXPJQ2aENOVg4IFy76/0unXaupOZzcF8Kd9FDfD70fOsko+4hE:GkamQ25OVFcPnKuphJdP0fOQ+s7o
TLSH
T1E8D53303C43375A7C10BFCB3A774140FDA6A694A7925849CED8FDCF18C855A676F2A60
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e
MD5 1c5483230e8da80c6b614ef4ba5838b1
SHA1 2b1f0e11c9104206209e688be362a783543590b4
SHA512 dfd4a4432eb88de61f4959631eb8ba053913350820984cdb966e22dfd8a16adfba31b5ff90ccdd3997d3ea3e24e97aff0a1e079c314d712c1e5fe6b0e06acc32
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8T:T6BJUoROZfIA8Xf8xumvBh8huTEEmk
TLSH
T11A665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e.zip

a534208ec5dba057f86ae22f7475dd8ae8841c4d56e5fe4d1ab0891fb4f1f64e

kernel32

generic