xvclipper | 2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994.zip
Size 2.7MB
Sample261002-r5ea6a1fqa
SHA256 99e5937e7b9331792b6c1dca85e3029b12f873ee56373a569ba88abb4ddfde08
MD5 bced85cd89e6e2c39aa099bfe28d8c7a
SHA1 bb2555a4cd04de207cfd956f47fe398275e1c99b
SHA512 d05be3a15690f5aba30bd04412bd9d231c2d496f1ec7503d790b31155edf8f48874a9b8336e7ddec298347e7ec27d010ad818ab3a96a1c1db295f30ba1620198
SSDEEP 49152:5RY6+qtD3NmsRt3xh9bmIwORlvLp8Ncwqc0ks2Fo98ENnUe/MFVdGboo2rfn:AjyzNVRtTgIJzM+kHTuUehGrn
TLSH
T1A0D533552C4203E1B7E5CB72C240B58C992F997E06ADD65A4E066779303FC8E36EE4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994

File Explorer

2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994.zip

.zip 2.7MB
2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994

.exe 6.5MB

2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994.zip

SHA256 99e5937e7b9331792b6c1dca85e3029b12f873ee56373a569ba88abb4ddfde08
MD5 bced85cd89e6e2c39aa099bfe28d8c7a
SHA1 bb2555a4cd04de207cfd956f47fe398275e1c99b
SHA512 d05be3a15690f5aba30bd04412bd9d231c2d496f1ec7503d790b31155edf8f48874a9b8336e7ddec298347e7ec27d010ad818ab3a96a1c1db295f30ba1620198
SSDEEP 49152:5RY6+qtD3NmsRt3xh9bmIwORlvLp8Ncwqc0ks2Fo98ENnUe/MFVdGboo2rfn:AjyzNVRtTgIJzM+kHTuUehGrn
TLSH
T1A0D533552C4203E1B7E5CB72C240B58C992F997E06ADD65A4E066779303FC8E36EE4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994
MD5 2ff9abaa212de8cce62c407ea1d1a632
SHA1 d2955fdef08ecda9ae1ea1f2d7cb741658121aa2
SHA512 025625789a428c6b3e4991e41042b47f36af3605937738ce64cde9c44494c9513e113913f26610df55354933f30e1696629dac2524a8a862c8ceb2183fd38521
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8/:T6BJUoROZfIA8Xf8xumvBh8huTEEmE
TLSH
T1B4665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994.zip

2021cb583833066ea5f541c13f5c79c120f41be51aaf65beb2f11f8a96c2e994

kernel32

generic