xvclipper | e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b.zip
Size 2.7MB
Sample261024-x9wc5aff56
SHA256 e0388a126fffadee5c026b339126b7044b8aff85247adc7577db158b11d4dd15
MD5 03206c60a35e73df34ba1d3bdfbf7c1c
SHA1 d19a30a021b84841a05edcd8dc327ebb4c2ee8c4
SHA512 3a33c1ae1982c6be6f8e00410f029d3a36c375b12de19eec02d898301f9b29065f0ad960f2051d1d1ce22198b4c5eacbc4a02bf0c33bbe7beaad94477aa2b39d
SSDEEP 49152:gcBKA8L4j+ldwGdGaKMOQyJSwotLZAlItZmMSCZ5vZEBhcpwjMM3FuJpqIq:g218LHwGdG/ShtL4Ama5vocpwN1uPfq
TLSH
T13FD533C22AE6BCD13F248E9E6084598305D1345BB89B38B0DF951C3EDE7EB515E8C798
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper xvclipper

Malware Config

Extracted

Family

xvclipper

https://api.telegram.org/bot8360155173:AAE15P4muFgLRsJedVHSUdOyoVP067RuPqk/sendMessage?chat_id=7366554655

Mutex

Global\OneDriveSyncMutex

Signatures

Family: XVClipper
XVClipper is a Windows clipper written in Golang.
clipper xvclipper

Custom signature

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b

File Explorer

e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b.zip

.zip 2.7MB
e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b

.exe 6.5MB

e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b.zip

SHA256 e0388a126fffadee5c026b339126b7044b8aff85247adc7577db158b11d4dd15
MD5 03206c60a35e73df34ba1d3bdfbf7c1c
SHA1 d19a30a021b84841a05edcd8dc327ebb4c2ee8c4
SHA512 3a33c1ae1982c6be6f8e00410f029d3a36c375b12de19eec02d898301f9b29065f0ad960f2051d1d1ce22198b4c5eacbc4a02bf0c33bbe7beaad94477aa2b39d
SSDEEP 49152:gcBKA8L4j+ldwGdGaKMOQyJSwotLZAlItZmMSCZ5vZEBhcpwjMM3FuJpqIq:g218LHwGdG/ShtL4Ama5vocpwN1uPfq
TLSH
T13FD533C22AE6BCD13F248E9E6084598305D1345BB89B38B0DF951C3EDE7EB515E8C798
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b
MD5 25f0807c37f1a758e01ee80bc7506a20
SHA1 2dcd3696ed5b1c75a400a3edc9cffd7c84ba95ba
SHA512 ec53ef0ae44bdf6eda614a95079fc09421e8cb3e425f6890f33c76a0ed84272757dd5167d62cda2194c024f63c47d1342dc6f3e95297f354cd3d01bc70983ecb
SSDEEP 49152:T6A6sw7kBBVRXAaKjQNkBoYFK8BZja/rqI5ZjqYHK9/9M2aj+NDtk8iKQK1K6f8P:T6BJUoROZfIA8Xf8xumvBh8huTEEm6
TLSH
T163665C53EC6555E8C5ADE1718A739253BBB17C881B2123D32B90F2252F73BD0ADB9348
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

556448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

406KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b.zip

e2736119d98ded3550a8a379bd80aa4801cf4bcb7668f71c666597ba91faa26b

kernel32

generic