xvclipper | fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a.zip
Size 2.7MB
Sample260917-stc5dssflf
SHA256 4c7f9f66cf04f56fb20612f4c6cda0b59afebbad897d8eb8b416e3f5878d965f
MD5 e3fe6aa50f36962f25643765ed4f0639
SHA1 b4a1045f83b8fd0af138d8d201ca5613cd67ecb9
SHA512 856fb571701fbfc654ad44b726e1e559204b083aa3d7d59bc71d9165d4cc01d67351b327e1ac83979cf16cc7c68cd8d193283f548d813f3b1370d06f803a3fb8
SSDEEP 49152:QfpD8MNFRQM5MJvx7iyNWLfBeSMjB3bcv289q5tbet8sVFbEFsxtV4L/k6TcnMU4:sd1MJvhiyNWLZeSI54lutbs14sxtSDTd
TLSH
T1AFD5331E55196D1FE6F310C94CC3BD3CAD36328DE0557ACA862219EEE630A4C7CA62DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a

File Explorer

fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a.zip

.zip 2.7MB
fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a

.exe 6.5MB

fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a.zip

SHA256 4c7f9f66cf04f56fb20612f4c6cda0b59afebbad897d8eb8b416e3f5878d965f
MD5 e3fe6aa50f36962f25643765ed4f0639
SHA1 b4a1045f83b8fd0af138d8d201ca5613cd67ecb9
SHA512 856fb571701fbfc654ad44b726e1e559204b083aa3d7d59bc71d9165d4cc01d67351b327e1ac83979cf16cc7c68cd8d193283f548d813f3b1370d06f803a3fb8
SSDEEP 49152:QfpD8MNFRQM5MJvx7iyNWLfBeSMjB3bcv289q5tbet8sVFbEFsxtV4L/k6TcnMU4:sd1MJvhiyNWLZeSI54lutbs14sxtSDTd
TLSH
T1AFD5331E55196D1FE6F310C94CC3BD3CAD36328DE0557ACA862219EEE630A4C7CA62DD
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a
MD5 05e2a8ef5dd59ee42b2c1e6feb79aa46
SHA1 8169f12d87631d185d81e3f8fa4c30460e858a20
SHA512 bc2feed0237dc210303b23b33738c07bb2ca6f0390e22529df63fb5bbafd0c7fe195d85542f863ba72529fe8f016fd9e0631c878b06a2d2c30d360dc6c59d09c
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8m:T6BJUoROZfIA8Xf8xumvBh8huTEEm0O
TLSH
T1F6665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a.zip

fd138e66d70dd53edb897bd5a37d67c66fcf2ffdca85a0bc51803911f3412c3a

kernel32

generic