xvclipper | 2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a.zip
Size 2.7MB
Sample260925-sdggwaydnd
SHA256 d1c1a4b168c0291fdf0d6d3e322c98d1d589b3582b8d5cbb4274c13e387f8925
MD5 071ba329f35d4cd21c370086865f4db2
SHA1 a5525f32fe482fec7a9e2fae75b26b49eee3a85e
SHA512 8e7aeb9e3c250f93dde70a75b35ddf4797117c12a44c6a26e03164af36232130482552f9589f97b32874c95fe0a59c91cda4c94a2665afbb48007174f778768d
SSDEEP 49152:XdZlautMOWgdvbMeO2o7HxoWnMRER7R7SAZ7gL1GlNu2gP6mX4jGX:nla2MlAbJRoloWnjxR7SAZ7g4lNXgP9H
TLSH
T148D533D8E616742453B7287C1508AE72F685616FB0CCE9413EECCE1B49F8A7B1BC9634
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a

File Explorer

2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a.zip

.zip 2.7MB
2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a

.exe 6.5MB

2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a.zip

SHA256 d1c1a4b168c0291fdf0d6d3e322c98d1d589b3582b8d5cbb4274c13e387f8925
MD5 071ba329f35d4cd21c370086865f4db2
SHA1 a5525f32fe482fec7a9e2fae75b26b49eee3a85e
SHA512 8e7aeb9e3c250f93dde70a75b35ddf4797117c12a44c6a26e03164af36232130482552f9589f97b32874c95fe0a59c91cda4c94a2665afbb48007174f778768d
SSDEEP 49152:XdZlautMOWgdvbMeO2o7HxoWnMRER7R7SAZ7gL1GlNu2gP6mX4jGX:nla2MlAbJRoloWnjxR7SAZ7g4lNXgP9H
TLSH
T148D533D8E616742453B7287C1508AE72F685616FB0CCE9413EECCE1B49F8A7B1BC9634
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a
MD5 220f283486775888e56d48c48f8951f3
SHA1 91176932715d734b38783c983b879c51df132392
SHA512 4e948e6318da9bb3fdff55816b53368e2a782c7d4225e6439fdc1e73b9a349795f9c44c2cce0460ea1129eebcae68c6a259fd06be8ec47266fae84d81eb9ba20
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8X:T6BJUoROZfIA8Xf8xumvBh8huTEEmNc
TLSH
T119665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a.zip

2b0cf8ad5b8bddb75c0f9185b4ce48609542b2a681758cc696c487c891402c9a

kernel32

generic