xvclipper | 94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe.zip
Size 2.7MB
Sample260917-strmsaff87
SHA256 ce78d956c446fa744f024d4512436da704aab5d34fdbe2ac98338aa469fa073d
MD5 42a18fe363e9fd12bfee12d4a44d7dd9
SHA1 1bcc38c838c88c527f87d2da2d54f9d56be5c93d
SHA512 dce52de570559536b6b89c8f91093dcec53584d2963d7ea8c45deda04afa23439de47bc52ca50f8685da9bbbb0108260bd568d90a944dce90dbf6f10ff4c38ed
SSDEEP 49152:REHdkTeNHNX3xM4Q82uFs7306HWg4tyVKgLi4cAp80aQ1dm1dy8b:RlebX3q94FsQ6HWnEVKgLicpaQ1dkb
TLSH
T17FD533E3CB954E39E94E1C5631A5298B233C1A81FC0CF6D62484B1BC8F529D6D16FF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe

File Explorer

94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe.zip

.zip 2.7MB
94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe

.exe 6.6MB

94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe.zip

SHA256 ce78d956c446fa744f024d4512436da704aab5d34fdbe2ac98338aa469fa073d
MD5 42a18fe363e9fd12bfee12d4a44d7dd9
SHA1 1bcc38c838c88c527f87d2da2d54f9d56be5c93d
SHA512 dce52de570559536b6b89c8f91093dcec53584d2963d7ea8c45deda04afa23439de47bc52ca50f8685da9bbbb0108260bd568d90a944dce90dbf6f10ff4c38ed
SSDEEP 49152:REHdkTeNHNX3xM4Q82uFs7306HWg4tyVKgLi4cAp80aQ1dm1dy8b:RlebX3q94FsQ6HWnEVKgLicpaQ1dkb
TLSH
T17FD533E3CB954E39E94E1C5631A5298B233C1A81FC0CF6D62484B1BC8F529D6D16FF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe
MD5 41ba12dd30bcabd44325e69d3dbe0012
SHA1 5fe2e01d8172fb3ad974e20615f9ef2b33f2d161
SHA512 61f38eeb72c447d0f779414b833d7adf165f3fe0c06c391ba5a7c89aba81e245c882747bd690708177dc48d7f51fec2812216c69c5f1eadd424f28b13192aff5
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8N:T6BJUoROZfIA8Xf8xumvBh8huTEEm5q
TLSH
T101665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe.zip

94b7283f4ca69401030283e9566fd5d1af298d9111d250fce3e18ae56594e5fe

kernel32

generic