xvclipper | 3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b.zip
Size 2.7MB
Sample260925-q7129sxeqd
SHA256 59884c2a02c0352af80dc0ad480bb0b96d986a7494ec09e7b6711b178245e0a7
MD5 aadf36fbc7661a386557f554b80f636a
SHA1 ce3b59d50899e0f0b2893b0fbde0383717ea6623
SHA512 cf3fc17bc2fc3c595a827a091dfeb2a0a8519b4b03e96457a62f30ddce5dc001f455fcec568ea94064ead34735b0dcf6fac6ffbaabd882883a2a530767df1318
SSDEEP 49152:2aJp+AaQ+q6umpDn3gXW/pnpHeZZ2NkPD70dwmcKaYzbv8EWrO227RDAXyY:HMAaPu6Dn3//pXNkP3iZpNzLllDAiY
TLSH
T148D5335B6FDA89B0FE9B068317DA10DD8FF5824F6AE9B0117D7617F4126018C627BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b

File Explorer

3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b.zip

.zip 2.7MB
3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b

.exe 6.5MB

3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b.zip

SHA256 59884c2a02c0352af80dc0ad480bb0b96d986a7494ec09e7b6711b178245e0a7
MD5 aadf36fbc7661a386557f554b80f636a
SHA1 ce3b59d50899e0f0b2893b0fbde0383717ea6623
SHA512 cf3fc17bc2fc3c595a827a091dfeb2a0a8519b4b03e96457a62f30ddce5dc001f455fcec568ea94064ead34735b0dcf6fac6ffbaabd882883a2a530767df1318
SSDEEP 49152:2aJp+AaQ+q6umpDn3gXW/pnpHeZZ2NkPD70dwmcKaYzbv8EWrO227RDAXyY:HMAaPu6Dn3//pXNkP3iZpNzLllDAiY
TLSH
T148D5335B6FDA89B0FE9B068317DA10DD8FF5824F6AE9B0117D7617F4126018C627BCA0
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b
MD5 0a1a5cfd30381fb0c3534904f7aa510a
SHA1 02b9f41077341afd6a4c84a8793ba87c22444749
SHA512 465f799a652a0d675b8f14b1b7057d02680211a30b38d8ec8c458ed23aecc6e2bc06f6915c3643568e3de84b3596e1df9a4b18266bafe1cc434ba8d97f6e52da
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8P:T6BJUoROZfIA8Xf8xumvBh8huTEEmNS7
TLSH
T1AF665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b.zip

3e439bae453fd08ea1f1737f133634490f014c5ef7b9f48a9f05b88628e3a85b

kernel32

generic