MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3caef7bfa316e674db8e690d93e8be7079f236cc3272e1bd37f2c77d0bd44b97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ZigClipper

Vendor detections: 5

Intelligence 5 IOCs YARA 26 File information Comments

SHA256 hash:	3caef7bfa316e674db8e690d93e8be7079f236cc3272e1bd37f2c77d0bd44b97
SHA3-384 hash:	0a64a89e4084751603600c227351cdfe26f5736af06a90706f5f3ea49781ff9d32137e4bfb8c16b3c38336216d323056
SHA1 hash:	cb983816dd39a251c4c43d1e51b168dc7a468cdd
MD5 hash:	394d023495c67d835e802a923985f8b9
humanhash:	yellow-mars-july-london
File name:	file.idx
Download:	download sample
Signature	ZigClipper Create hunting rule
File size:	2'049'900 bytes
First seen:	2026-11-10 01:41:00 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	49152:tU/bZc/fqbe9uivKt6AEb+iNwhMme3vQWvURlgX:iTZcnqbAuiCt6Ah4whmvQ6+lgX
TLSH	T1F79533E47D2FE04E5B1989D0C95C2541031EC8AF2B59A5E1FC03DB6938F9293A2B376D
Magika	zip
Reporter	aachum
Tags:	clientservices12-cozyloft-cc dropped-by-ACRStealer ZigClipper zip

iamaachum

https://we.cloudrack.in.net/file.idx

ZigClipper C2: https://clientservices12.cozyloft.cc/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/fddda95d-a9c5-4daa-b3ad-11a9139732fd/

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af27661463538821bc379bf

Tags:

micro

Result

Verdict:

Clean

File Type:

PE File

Link:

https://app.docguard.net/3caef7bfa316e674db8e690d93e8be7079f236cc3272e1bd37f2c77d0bd44b97/results/dashboard

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm installer-heuristic microsoft_visual_cc packed signed

Link:

https://www.filescan.io/uploads/6af2763bd545e0f57d23735b/reports/cbe2c276-069f-4aff-8c64-e9bb5f0a8501/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/3caef7bfa316e674db8e690d93e8be7079f236cc3272e1bd37f2c77d0bd44b97

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.23 Zip Archive

Link:

https://app.malva.re/file/394d023495c67d835e802a923985f8b9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3caef7bfa316e674db8e690d93e8be7079f236cc3272e1bd37f2c77d0bd44b97/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hsxppp5dc3thjw4onegzh2f6ob47enwmgjzodpjx6ldx2c6ujolq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/261110-hkw6ssg19w/

Behaviour

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3caef7bfa316e674db8e690d93e8be7079f236cc3272e1bd37f2c77d0bd44b97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	drv_MmMapIoSpace Create hunting rule
Author:	h_s
Description:	Detects MmMapIoSpace import from NtosKrnl.exe

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	extracted_at_0x44b Create hunting rule
Author:	cb
Description:	sample - file extracted_at_0x44b.exe
Reference:	Internal Research

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	signed_sys_with_vulnerablity Create hunting rule
Author:	wonderkun
Description:	signed_sys_with_vulnerablity

Rule name:	test_rule_vldslv Create hunting rule

Rule name:	TigerRAT_pe_yaraify Create hunting rule
Author:	hunts-yara-code
Description:	YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

Rule name:	WIN_Malware_PsychedelicStealer_ForgeAuto_14838da1_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects PsychedelicStealer (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_3ee43008 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4fa7e284_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_7b770d80 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_ac9e4d5b Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_eddadcfa Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_ValleyRAT_ForgeAuto_401c5e16 Create hunting rule
Author:	Marjoriefort
Description:	Detects ValleyRAT (pe, etat binaire)

Rule name:	WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects XWorm (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZigClipper

ps1 402bc9492ec70d863ef5642741dcea837fd6e0c759863237959b1fb774ee1ed9

ZigClipper

zip 3caef7bfa316e674db8e690d93e8be7079f236cc3272e1bd37f2c77d0bd44b97

(this sample)

any.run

https://app.any.run/tasks/78019fc5-d2f4-4192-830c-9c8057f40808

Dropped by

SHA256 402bc9492ec70d863ef5642741dcea837fd6e0c759863237959b1fb774ee1ed9

Delivery method

Distributed via web download

Dropped by

MD5 6553a0bd8028a35499fa310dfa3dfa99

URLhaus

https://urlhaus.abuse.ch/url/4062441/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample