xvclipper | ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04.zip
Size 2.7MB
Sample261014-rzz1nset71
SHA256 2d43a0684afab76d3a3661838ae950d9a48896951104cf1bc8f55a7050a1ac43
MD5 72fe9dc4ffb6e81034b26c6331f278da
SHA1 0f6bef17c0f2e88b13aca23d2196ec0bddc82a37
SHA512 36d621363f8cb1c316fbc1582d8fbcbe4064e01a2db2ccfc1f051fa4c35d1bde606a9acb4572954d59a4c2b45e131eda61d987f471848357c728d9bb43a12b0e
SSDEEP 49152:SM+TjqCHVaRUwQMusIkvDi372VrTE4r3aDG/0J8sPidUHswUBUw:X/UHM0DLGn3sGNLyH0
TLSH
T12BD5331585CCA647A8A1523D0D20EFB853DDE80ECB657783960A63B06CF27772731A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04

File Explorer

ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04.zip

.zip 2.7MB
ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04

.exe 6.5MB

ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04.zip

SHA256 2d43a0684afab76d3a3661838ae950d9a48896951104cf1bc8f55a7050a1ac43
MD5 72fe9dc4ffb6e81034b26c6331f278da
SHA1 0f6bef17c0f2e88b13aca23d2196ec0bddc82a37
SHA512 36d621363f8cb1c316fbc1582d8fbcbe4064e01a2db2ccfc1f051fa4c35d1bde606a9acb4572954d59a4c2b45e131eda61d987f471848357c728d9bb43a12b0e
SSDEEP 49152:SM+TjqCHVaRUwQMusIkvDi372VrTE4r3aDG/0J8sPidUHswUBUw:X/UHM0DLGn3sGNLyH0
TLSH
T12BD5331585CCA647A8A1523D0D20EFB853DDE80ECB657783960A63B06CF27772731A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04
MD5 00dda9928fc75377356dcab998edc54d
SHA1 86f630d1015046358dbdbe2836a638b38c461f7c
SHA512 6ac6fff5ad908dceae41531035abec57384648225a57d29c5b63e75bfef5766c4546c0d744a05afcfa99e812245180f18b1286c473deffac0fee73966f7a45e1
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8r:T6BJUoROZfIA8Xf8xumvBh8huTEEmL1K
TLSH
T10C665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04.zip

ad392d1886817fb97376de63f90a9ff32392e77e3711339e7aee804d732a6f04

kernel32

generic