xvclipper | cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4.zip
Size 2.7MB
Sample261016-rnxfeavxaz
SHA256 5fb5c80ba5710840a5fd5656379bab8edfb85a2c0b00298f3cdee369c6a24989
MD5 4ab425cb975f263065eadd001ead1a61
SHA1 a0bc04e8d534c1e2d7e8964949095310fcb35012
SHA512 0b691d1ddd6936d1a66dcc1736488e387988f1f2f7acd638f9cba397e117ab3a31453276096a7b00e7b099bc0e8064f4a0c39b6aafb1a902cc2d942563becb59
SSDEEP 49152:6XisIvUOq8QVttRzM+Mxrhe6uIvvEni+x8Reih9QG1ksvpugFbRodSJUevvONOx6:6jIvxq8Q1RzMBh5ZnuiJRDQzINoQq6mT
TLSH
T1FAD53351D3B26F20411F3CBBB3931BF8516CF6220BCC2E59867D79B14A87E121E76859
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4

File Explorer

cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4.zip

.zip 2.7MB
cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4

.exe 6.5MB

cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4.zip

SHA256 5fb5c80ba5710840a5fd5656379bab8edfb85a2c0b00298f3cdee369c6a24989
MD5 4ab425cb975f263065eadd001ead1a61
SHA1 a0bc04e8d534c1e2d7e8964949095310fcb35012
SHA512 0b691d1ddd6936d1a66dcc1736488e387988f1f2f7acd638f9cba397e117ab3a31453276096a7b00e7b099bc0e8064f4a0c39b6aafb1a902cc2d942563becb59
SSDEEP 49152:6XisIvUOq8QVttRzM+Mxrhe6uIvvEni+x8Reih9QG1ksvpugFbRodSJUevvONOx6:6jIvxq8Q1RzMBh5ZnuiJRDQzINoQq6mT
TLSH
T1FAD53351D3B26F20411F3CBBB3931BF8516CF6220BCC2E59867D79B14A87E121E76859
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4
MD5 006596fd3ac09917df4bf2acbc4e96f0
SHA1 63ab1d04af3fe64ce273fb23167764868fdccf60
SHA512 5a922882e0bd88a376d3e4597dc5641acbc8d6b65a737cca62783c7f9bbd4a777afd27a5b0cbec24c663070778af9f5587b3c4cdc519101c6b7a9c939e7dd10b
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8m:T6BJUoROZfIA8Xf8xumvBh8huTEEmp
TLSH
T1CB665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4.zip

cf9d2bf28eddae75c7d4d18669b28dc2d340c0c29f4820ce40a576233a4e65f4

kernel32

generic