xvclipper | 5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517.zip
Size 2.7MB
Sample260918-vbk4dsbm7t
SHA256 d254a88df69d803a3f96e479f79f4f6a0466efb3f9501f921f4db14f7aad365e
MD5 2206537a54228aa6213e61cb66b8b7f8
SHA1 d163564b755fc7d1efc3f192abb8488cca0841fe
SHA512 c6deec9a21c08d35a5bb78c65bcbd1648acf39ed0e714642d688cb930c1c4075454cf82b8ebd14497af98fe9a6f7bfdb8f981cc958b9e6eee63ac1ef09d9f48b
SSDEEP 49152:yyIT7MAkFYOhCHuSyilDqIsn4TX11GQ3O7NZ86EObRqQm2ei1qly1leBM:yz4AkXCOSyeq14z1EUOz86kLi1Oyje6
TLSH
T15DD5333376E7B60315DAF287FEDA59280B52D9956A476CB28135887CF90253B00F2E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517

File Explorer

5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517.zip

.zip 2.7MB
5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517

.exe 6.5MB

5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517.zip

SHA256 d254a88df69d803a3f96e479f79f4f6a0466efb3f9501f921f4db14f7aad365e
MD5 2206537a54228aa6213e61cb66b8b7f8
SHA1 d163564b755fc7d1efc3f192abb8488cca0841fe
SHA512 c6deec9a21c08d35a5bb78c65bcbd1648acf39ed0e714642d688cb930c1c4075454cf82b8ebd14497af98fe9a6f7bfdb8f981cc958b9e6eee63ac1ef09d9f48b
SSDEEP 49152:yyIT7MAkFYOhCHuSyilDqIsn4TX11GQ3O7NZ86EObRqQm2ei1qly1leBM:yz4AkXCOSyeq14z1EUOz86kLi1Oyje6
TLSH
T15DD5333376E7B60315DAF287FEDA59280B52D9956A476CB28135887CF90253B00F2E1F
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517
MD5 13e8981eb59d3fa167325fd372d8663e
SHA1 0ca26b9516e3958a3c5a1467c1c175813ef17a1b
SHA512 e22d618fa18df2ee336581bb024c21d4df077c8496aa079dbcdae248e0ac053a70d0670c7f2558e4963c719bcff2a81fab2c64a8a3e70860898957ec871ba070
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f83:T6BJUoROZfIA8Xf8xumvBh8huTEEm7Y
TLSH
T158665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517.zip

5cb9b5d1b0f9c342ae0c45511441ba792be4e6bc6ec119ad9fdf68603c6c3517

kernel32

generic