xvclipper | 2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2.zip
Size 2.7MB
Sample261001-sr21qsvs8m
SHA256 ec3aa7e0251a0f0d46ada26700808f8e438c94f44ffb3d5e9b8437e80d25bf29
MD5 65fdc3003286465b70e9a55fb1f721f9
SHA1 e4fba0daae35eeb6c4d448ab198f4f1a2b35fd58
SHA512 8389ad2ba0d019d4749a755c473aa7864849848be3565b5bfff592de2f345f7ba190892bc370856f6a74fad8b714d02cb55562e19e625ad2ddad0ae94fc674b0
SSDEEP 49152:4mSAiWHsQ/0kX414vQQbSKmcfZrC0U5lR+Q/MVv3bHqLqjxJnUnKia3bzIkEtlw:4mSAiWHsQcu414vQQGKmorC0UIQozq2R
TLSH
T1EBD5330B08F8294735189BBE311046F95F1EADD1E9A8216FE5E59EFD9E341F92AF40C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2

File Explorer

2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2.zip

.zip 2.7MB
2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2

.exe 6.5MB

2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2.zip

SHA256 ec3aa7e0251a0f0d46ada26700808f8e438c94f44ffb3d5e9b8437e80d25bf29
MD5 65fdc3003286465b70e9a55fb1f721f9
SHA1 e4fba0daae35eeb6c4d448ab198f4f1a2b35fd58
SHA512 8389ad2ba0d019d4749a755c473aa7864849848be3565b5bfff592de2f345f7ba190892bc370856f6a74fad8b714d02cb55562e19e625ad2ddad0ae94fc674b0
SSDEEP 49152:4mSAiWHsQ/0kX414vQQbSKmcfZrC0U5lR+Q/MVv3bHqLqjxJnUnKia3bzIkEtlw:4mSAiWHsQcu414vQQGKmorC0UIQozq2R
TLSH
T1EBD5330B08F8294735189BBE311046F95F1EADD1E9A8216FE5E59EFD9E341F92AF40C0
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2
MD5 2db57ebf8baac0edeb32141a3f0f8402
SHA1 4a92964933e6817e5d23f4ba0de204925674ec7b
SHA512 888a760c6378588a432ccd1b0a1a84b652f0260c3d629ffd1573cb2975b7ec789dd9f9bf36a4dacaace43d5bc26e7d2baa43eb234e9282fba5d6dee1010f6c70
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8Z:T6BJUoROZfIA8Xf8xumvBh8huTEEm7a
TLSH
T18E665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2.zip

2ed71a5289d847a9b4d1b6f88e483bd0b9e4f0c6fdeaf04ebb5073a205d624d2

kernel32

generic