xvclipper | ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe.zip
Size 2.7MB
Sample260930-q2qdkszzev
SHA256 c2a6fb893fd4860ace6ef4c21a0a10b5fedf87e7aaf9270842df674f80dc537c
MD5 461938df958f2a753daea158c46f1a55
SHA1 fc3b0ab7e2af8e3534a159a00577db0d312f77a2
SHA512 ba6ecc76219f3604d895b2490acce793eb7c4d50c4c70e838b7bc630e3a097041f353e43853fcfb712f98bd7a4f9729c31a32290c8f05e319cc9e32552304aa9
SSDEEP 49152:3ihHN8nabMaUUgxIP4b8lcjvJQjOBpqinWroyVDDyK6EsStwWH30Q1xG4aI9xuDp:3iht8nVaUU4uDKjvuCtnWEct62yWEQ1s
TLSH
T11AD533831ED619C4FE347BE882BA8F151BA26E2827F393360B4DC3164D1581D7851ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe

File Explorer

ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe.zip

.zip 2.7MB
ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe

.exe 6.5MB

ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe.zip

SHA256 c2a6fb893fd4860ace6ef4c21a0a10b5fedf87e7aaf9270842df674f80dc537c
MD5 461938df958f2a753daea158c46f1a55
SHA1 fc3b0ab7e2af8e3534a159a00577db0d312f77a2
SHA512 ba6ecc76219f3604d895b2490acce793eb7c4d50c4c70e838b7bc630e3a097041f353e43853fcfb712f98bd7a4f9729c31a32290c8f05e319cc9e32552304aa9
SSDEEP 49152:3ihHN8nabMaUUgxIP4b8lcjvJQjOBpqinWroyVDDyK6EsStwWH30Q1xG4aI9xuDp:3iht8nVaUU4uDKjvuCtnWEct62yWEQ1s
TLSH
T11AD533831ED619C4FE347BE882BA8F151BA26E2827F393360B4DC3164D1581D7851ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe
MD5 2fd9293bb4ac06fa9ac6d865d40ab1b1
SHA1 caec3e6b3f550d92a66c72763b4f25053b0a7905
SHA512 1e32ce7a6cc7e02c98c488fc40f48ed2965089ae0f834be0c7dedac13c2bc59299f883a28978dfb3cc412bfb51c713e463cd3ee4321fcb53ac15748fb213d20a
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8s:T6BJUoROZfIA8Xf8xumvBh8huTEEmYQ
TLSH
T1ED665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe.zip

ae72d2a2b8e128a8324e561d62673668ad08ca18e41a7e0bd70c7100a728f7fe

kernel32

generic