animateclipper | 2026-11-05_d6a685a3524e53c0ed18ab5829c93f4c_cobalt-strike_icedid_megazord_njrat_ryuk_voidlink

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-05_d6a685a3524e53c0ed18ab5829c93f4c_cobalt-strike_icedid_megazord_njrat_ryuk_voidlink
Size 233KB
Sample261106-jk2lysbc88
SHA256 804778b6ef86bb18eb82b3d639d8caaf6de15509f863ed5dd6e4a1bb8bbf122e
MD5 d6a685a3524e53c0ed18ab5829c93f4c
SHA1 fd8d63330c8a37a4cd07b618d8958aff0a51f14c
SHA512 c8841c23c50fe295558e84620788de27e4bd1fd1db14dd8fc7818e10bb36643f7a93103c4fd31b0c05b5d2a6eca91f9c00ac5fbe69b16b35f13ea06f1a6903ec
SSDEEP 3072:EZjPGKD7oCLWQiYfDJCnyIGet80fflSx1GccXAZ7Rll1OYPdVJ8p7Lfe9B7y2xBx:E1PBfDJSNpflSxdbZVtTmpPaJY
TLSH
T13E347C0572A55CF0ED37823D89928A45EA737C150721EAEF03E063666F636D09F3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

clipper stealer animateclipper

Malware Config

Extracted

Family

animateclipper

bsc.blockrazor.xyz

Mutex

update-S-2-5-26-24247216-2331352693-3112950123

Wallets

0x8eb9a56afbe6d79aa90fba9c8f6af7321490c786
1B7GRvB1WMZYNCz5FdXocHicUyp8pj1FvX
1Ht6TLmpMc3xhN5euPZo5ecC4RJtfJrJu8
3BJquhr9pnQhMo1RCPJHsKnrUKgs8StkKT
8SjFSqSJ6DYAcBJrNGN76hEhcij5vtyJK5G819CvV7Fm
DKSfYvjh8hZwR6q3nNvtKYrgK892groxfd
LNMjkFCv1R2T5vwvuXmUFHHeJLmYAdgzX3
TSw3kk2GCyUUsGnvR2ZHSNoEaWkhfkGE1J
UQCYdXT16Xxzr1qCSVxxntce0-UYXmcqJ_aodkoq39Fv2E6f
XdJHMeC11gmiA5rpnJhu9cTax61q333o1g
bc1qw8wnedcwur3e4pq6qpdrquxpd09a5lss5glf77
cosmos1pgtakf0xe8ehexdgqz9c3lj436wyyg772qec8m
ltc1qs9whv7632zyrr828n7e6g5jqtq0ykgklvfm80u
qphwpg3ja0awpjt2vrfy5mxmk3h24vrswg9ll9umkm
rKaNCgLvMEXxNzMxj2F7FYi1AdRrTo6Nhu

Attributes

auth_token
824c6b4d-4f01-4e22-a500-c7d239e10480
contract
0x77c08D8A4Eab268fd5728ae8fE41b1FDE52967dF
headers
Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480

Content-Type: application/x-www-form-urlencoded

Signatures

Family: AnimateClipper,ZigClipper
AnimateClipper is a Windows crypto clipper that hijacks the clipboard to swap wallet addresses.
clipper stealer animateclipper

Detects AnimateClipper 1 IoCs

resource	yara_rule
sample	family_animateclipper

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-05_d6a685a3524e53c0ed18ab5829c93f4c_cobalt-strike_icedid_megazord_njrat_ryuk_voidlink

File Explorer

2026-11-05_d6a685a3524e53c0ed18ab5829c93f4c_cobalt-strike_icedid_megazord_njrat_ryuk_voidlink

.exe 233KB

2026-11-05_d6a685a3524e53c0ed18ab5829c93f4c_cobalt-strike_icedid_megazord_njrat_ryuk_voidlink

IMPHASH 8ee686a16cc0819ec855423f5a62ed0d
SHA256 804778b6ef86bb18eb82b3d639d8caaf6de15509f863ed5dd6e4a1bb8bbf122e
MD5 d6a685a3524e53c0ed18ab5829c93f4c
SHA1 fd8d63330c8a37a4cd07b618d8958aff0a51f14c
SHA512 c8841c23c50fe295558e84620788de27e4bd1fd1db14dd8fc7818e10bb36643f7a93103c4fd31b0c05b5d2a6eca91f9c00ac5fbe69b16b35f13ea06f1a6903ec
SSDEEP 3072:EZjPGKD7oCLWQiYfDJCnyIGet80fflSx1GccXAZ7Rll1OYPdVJ8p7Lfe9B7y2xBx:E1PBfDJSNpflSxdbZVtTmpPaJY
TLSH
T13E347C0572A55CF0ED37823D89928A45EA737C150721EAEF03E063666F636D09F3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects AnimateClipper
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

ole32

CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

kernel32

CloseHandle CreateFileW CreateMutexW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTickCount GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleTextAttribute SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile

user32

CloseClipboard EmptyClipboard GetClipboardData IsClipboardFormatAvailable OpenClipboard SetClipboardData

wininet

HttpAddRequestHeadersA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile

ntdll

NtAllocateVirtualMemory NtFreeVirtualMemory NtQueryInformationFile NtQueryVolumeInformationFile RtlAcquireSRWLockExclusive RtlEqualUnicodeString RtlExitUserProcess RtlReleaseSRWLockExclusive RtlWaitOnAddress

Name

.text

Size

140KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-11-05_d6a685a3524e53c0ed18ab5829c93f4c_cobalt-strike_icedid_megazord_njrat_ryuk_voidlink

oleaut32

ole32

kernel32

user32

wininet

ntdll

generic