xvclipper | 5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f.zip
Size 2.7MB
Sample260925-vmn97a1gpb
SHA256 22e4d00d24434381dbac29c4d63b45ea2ded7c2af5a39bff3ff82b7a639e73c8
MD5 2f43cc12bfc3a69f3c1c31ad014d26a3
SHA1 4ed236bacf94564334efa67cf71f2adfd25cbb41
SHA512 e001572c12e8cb65e7447e674350e085120dc6161daa756cf78a6e6382d7849d03f3d0f3d017b516964c00227dae8085240ee8aa61211cf5dc8e644de13ad305
SSDEEP 49152:fjfj1FR1z+GELCYWx6s4pinT5uXxCsR8/78idnQd6ZZME/npwIUlLM4EAo:fDJQLiBmiT5uXAsSPdQ4/eIUtVo
TLSH
T1FAD533C6D2B5A3C972282A6F54E2B30FE59F84144D9C4DC6CB35E1203EF74AB89F9251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f

File Explorer

5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f.zip

.zip 2.7MB
5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f

.exe 6.5MB

5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f.zip

SHA256 22e4d00d24434381dbac29c4d63b45ea2ded7c2af5a39bff3ff82b7a639e73c8
MD5 2f43cc12bfc3a69f3c1c31ad014d26a3
SHA1 4ed236bacf94564334efa67cf71f2adfd25cbb41
SHA512 e001572c12e8cb65e7447e674350e085120dc6161daa756cf78a6e6382d7849d03f3d0f3d017b516964c00227dae8085240ee8aa61211cf5dc8e644de13ad305
SSDEEP 49152:fjfj1FR1z+GELCYWx6s4pinT5uXxCsR8/78idnQd6ZZME/npwIUlLM4EAo:fDJQLiBmiT5uXAsSPdQ4/eIUtVo
TLSH
T1FAD533C6D2B5A3C972282A6F54E2B30FE59F84144D9C4DC6CB35E1203EF74AB89F9251
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f
MD5 25a74eb2bf7605316fda2ffdab125c0e
SHA1 5f102c50c9ba55defacc23bfa92ea1b979ecd575
SHA512 4acf83268f636147a2a7ff89df18a8033366eca2acb1fed3947e8c518d367456bf5ebaabe164c55eb5ea8800cd92eb4b62189abcb5d1adb0b9d194cb7d98c319
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f88:T6BJUoROZfIA8Xf8xumvBh8huTEEml
TLSH
T199665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f.zip

5aa27d14b32ed001a9c572bc6df3db4e032dda207bd5997bf9e109a9865a746f

kernel32

generic