xvclipper | 6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be.zip
Size 2.7MB
Sample260918-vb5g2ay13p
SHA256 9d5db91e69acd80000808127e1caa068019002c6e6337cf3301871ee0b732e74
MD5 a88fb3becd06940d421f3956bb50de77
SHA1 32a9080fcf0a0feb1d4387df00915c2045ee8cb4
SHA512 1489beff586f926a4eaf75bb6da520f98ad24c239b2f69f54c4466da5607c38ba0e1f38ec67a03ec0368116a82a24109531edadaf3e88009a368565fcf022dda
SSDEEP 49152:R2xwf3TINBN5SecBzBJgoIzcft1hYzp3j+UiRNcrea80JMHlxGS7TiDLlvaVX:R2OgBN/cpo6ftUNT+UiRKRJqxG3J8X
TLSH
T17BD533D7C2C22F56FC150779D84A78F4D4419EE7BB7AB183411D8914A960ABAC23CBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be

File Explorer

6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be.zip

.zip 2.7MB
6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be

.exe 6.5MB

6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be.zip

SHA256 9d5db91e69acd80000808127e1caa068019002c6e6337cf3301871ee0b732e74
MD5 a88fb3becd06940d421f3956bb50de77
SHA1 32a9080fcf0a0feb1d4387df00915c2045ee8cb4
SHA512 1489beff586f926a4eaf75bb6da520f98ad24c239b2f69f54c4466da5607c38ba0e1f38ec67a03ec0368116a82a24109531edadaf3e88009a368565fcf022dda
SSDEEP 49152:R2xwf3TINBN5SecBzBJgoIzcft1hYzp3j+UiRNcrea80JMHlxGS7TiDLlvaVX:R2OgBN/cpo6ftUNT+UiRKRJqxG3J8X
TLSH
T17BD533D7C2C22F56FC150779D84A78F4D4419EE7BB7AB183411D8914A960ABAC23CBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be
MD5 1803420422d8c58f91154e2275ed8841
SHA1 aac9173b6bc030d93b40f6adae69a0b9dc750755
SHA512 67b6159f914923edad67697c6d6ba8a67f6b16b9dc7b0a4cbaf33dec0b2aafcdf8e2540dd8e5dd46f1963f031844aa631edcaa6ec4f72a1fa2ff125e3d3dfd9e
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8v:T6BJUoROZfIA8Xf8xumvBh8huTEEmrk
TLSH
T1FD665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be.zip

6cd4de1641b588d3f157390e28b305b1e430b06c7c448577c6564edad39976be

kernel32

generic