xvclipper | bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b.zip
Size 2.7MB
Sample260930-r7dgmsad85
SHA256 ade3e183c37204d2c36f6effe7e9a42d3224006778be23fa5d98543c6d8ab843
MD5 ec73a1c17d5c99c4560ef9ef39ccef54
SHA1 b26a2e02cd511dae799aa576d3e98be7a570d299
SHA512 9759be8808e525f5569f77f750914b0149dae4ad98d378b373a2707a60ad9a37b363d8dee51785800120c26fc48c634798b0f9255ede70569194dd14c90cb4cb
SSDEEP 49152:+VQbvSs/+qve/74hfm0KIUAuqmCUJasxCen3Ywa5Zs0ysvfF5RHWEZxv24QSz0P:WPs/+z/khUBX3JjoeNivHWSv24tz0P
TLSH
T192D5335FB46AFD464B312B66925C0A2BDCC80210BFCC6DE6A6DB5D43EF082C05BD5AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b

File Explorer

bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b.zip

.zip 2.7MB
bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b

.exe 6.5MB

bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b.zip

SHA256 ade3e183c37204d2c36f6effe7e9a42d3224006778be23fa5d98543c6d8ab843
MD5 ec73a1c17d5c99c4560ef9ef39ccef54
SHA1 b26a2e02cd511dae799aa576d3e98be7a570d299
SHA512 9759be8808e525f5569f77f750914b0149dae4ad98d378b373a2707a60ad9a37b363d8dee51785800120c26fc48c634798b0f9255ede70569194dd14c90cb4cb
SSDEEP 49152:+VQbvSs/+qve/74hfm0KIUAuqmCUJasxCen3Ywa5Zs0ysvfF5RHWEZxv24QSz0P:WPs/+z/khUBX3JjoeNivHWSv24tz0P
TLSH
T192D5335FB46AFD464B312B66925C0A2BDCC80210BFCC6DE6A6DB5D43EF082C05BD5AC5
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b
MD5 1fcd3fde76fbb83c23b0c8b62869e3df
SHA1 815b8e9c0db0a716cf566c20844635a6e46a6a1e
SHA512 1d991cf12144c18b4b2f8d9606598067b85cf1b97b5b79dd3c7d2ecf11bae758552f117c30f8e76ef9b65f56bc555c31dac483dfe5e259714ec235ce5173b8eb
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8o:T6BJUoROZfIA8Xf8xumvBh8huTEEmD
TLSH
T1F4665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b.zip

bb7e79fe2c13d2f3b1372823fc3f7d600bfb23bf1efa5e8c358b2b9d0bc30f9b

kernel32

generic