xvclipper | 7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022.zip
Size 2.7MB
Sample261007-talsvs1vgs
SHA256 d5c8f0a988c13506e7101436818eb0dd501800f15ab9ff9708efa147493d0877
MD5 5536cdf6367596796c843a7999e8f4e0
SHA1 91ef63835984ffd49b682bd6e7b3b4cf353c2ae1
SHA512 5e8c9de78d88607e5d34e1b5b29d3d1c0b4cc9a5114e338baf5df1006e36c62e28898b79fff4297cabeee9445fe4db35b207e13b517e1c4c97e626626bab3173
SSDEEP 49152:L9Rv/vP2uVhltiGUKfvcRnw9qBU2Jzib2b0bAtJCCJ+EzMOdWhNgq/0VMC:L9Z+uVhzh3dqBtW1AtJxnB+0P
TLSH
T1A2D5333CED4C59F363AC5A046518273F22414FE26BB6CAD76237C7654206AE7D3A7C09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022

File Explorer

7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022.zip

.zip 2.7MB
7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022

.exe 6.5MB

7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022.zip

SHA256 d5c8f0a988c13506e7101436818eb0dd501800f15ab9ff9708efa147493d0877
MD5 5536cdf6367596796c843a7999e8f4e0
SHA1 91ef63835984ffd49b682bd6e7b3b4cf353c2ae1
SHA512 5e8c9de78d88607e5d34e1b5b29d3d1c0b4cc9a5114e338baf5df1006e36c62e28898b79fff4297cabeee9445fe4db35b207e13b517e1c4c97e626626bab3173
SSDEEP 49152:L9Rv/vP2uVhltiGUKfvcRnw9qBU2Jzib2b0bAtJCCJ+EzMOdWhNgq/0VMC:L9Z+uVhzh3dqBtW1AtJxnB+0P
TLSH
T1A2D5333CED4C59F363AC5A046518273F22414FE26BB6CAD76237C7654206AE7D3A7C09
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022
MD5 02de7883bb8554de23047d3167cce3ae
SHA1 64b51edabbb2866deeeca9c5d8c3375994da8596
SHA512 978a4123553ded37e311e1d7e450965234c7d84750a5b79b4824b4a736ce9c09a8c15044ae036e4e48577ca96b73423922393c9b619b12ec769775d2bf06b25a
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8n:T6BJUoROZfIA8Xf8xumvBh8huTEEmW
TLSH
T1D2665C53EC6555E8C5ADE1718A7392537BB17C881B2123D32B90F2252F73BE0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022.zip

7448a6d469c516a63ed8812de75cee037c2324e321ff4a58212000e8fb2d1022

kernel32

generic