xvclipper | 434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d.zip
Size 2.7MB
Sample261011-sytypscd42
SHA256 87fefc5e7a74e69aec1f98bb31c75d1fee014efc385fe8cbb8fb112ea8490a94
MD5 c449ae237a6a8ea938694d75e700c39e
SHA1 fc143d80c75033c646b3e2fbf21ce634fcce84ca
SHA512 928b42d306093ff2e04df62875640e263a5bca7f9494a1526c0d8bf1a2bfeee85cdc4bfd552b037d15176ccebbbf89abf985a5e9f460955b8c06c5ce573c97ee
SSDEEP 49152:UniZcIa83T1c0RRjkXzWC9s23mAvalQsq5+HxxEPdcvXBLlzQPx6CnlP9f4:UniZcJ81RCnaO+HUPSvXBGPZFA
TLSH
T18AD5333B3EAFC79D37843D929EB7010B3D4DBE74A64AEB33AA529D6919060013C456E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d

File Explorer

434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d.zip

.zip 2.7MB
434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d

.exe 6.5MB

434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d.zip

SHA256 87fefc5e7a74e69aec1f98bb31c75d1fee014efc385fe8cbb8fb112ea8490a94
MD5 c449ae237a6a8ea938694d75e700c39e
SHA1 fc143d80c75033c646b3e2fbf21ce634fcce84ca
SHA512 928b42d306093ff2e04df62875640e263a5bca7f9494a1526c0d8bf1a2bfeee85cdc4bfd552b037d15176ccebbbf89abf985a5e9f460955b8c06c5ce573c97ee
SSDEEP 49152:UniZcIa83T1c0RRjkXzWC9s23mAvalQsq5+HxxEPdcvXBLlzQPx6CnlP9f4:UniZcJ81RCnaO+HUPSvXBGPZFA
TLSH
T18AD5333B3EAFC79D37843D929EB7010B3D4DBE74A64AEB33AA529D6919060013C456E4
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d
MD5 36a4addfb2874c3ecd388612c8b66ab7
SHA1 9afc4204c26ef24906ead9d005aead044ece55f3
SHA512 963faed50f3da9aa26d560b45cb244115259c7e31e6551741d140a449eb5d4b84f09452fa42e6fbeb52b0d191d8c5e4ac1f89f0df95aa52d543f291429b1ac8f
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8M:T6BJUoROZfIA8Xf8xumvBh8huTEEmLv
TLSH
T15E665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d.zip

434a0571a6730bce3afd6511eff1c0646d7c7e9c252acc16af2be60a571eea0d

kernel32

generic