MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AnimateClipper


Vendor detections: 11


Intelligence 11 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645
SHA3-384 hash: e0a0c1431dde40a1ff41a54b95ae2137a4bff4d57179a224e75eda5b7a4c814f43ec78509d5885b60efd911761981778
SHA1 hash: 53de9d6e3d7816d949aa1adcb479f73367da8cc2
MD5 hash: 450e0227f0118633049d3c4f1e79fafc
humanhash: cold-pip-bacon-speaker
File name:file
Download: download sample
Signature AnimateClipper
Create hunting rule
File size:10'488'832 bytes
First seen:2026-07-26 03:41:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 71b008ad892c449add994b5e45fffabc (2 x AnimateClipper, 2 x PureLogsStealer)
ssdeep 24576:iY6TYOe2pP1y2DjTHcmQhPT+mP82giMTRuccsUCsRq:iY6TYOEmQB+mmB9UCaq
TLSH T16AB67B15A3A15EE8D226817CCA964232F6B57741C760AACB0274D2193E37BF46E3FF11
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter Bitsight
Tags:3fc2270f9ceb525e5c2d1d101bccd90f AnimateClipper dropped-by-Remus exe


Avatar
Bitsight
url: https://lapidorseposoalovbs2.com/cleen_trs1.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76203/
Detection(s):
SecuriteInfo.com.Variant.Yogi.23082.38422535.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Using the Windows Management Instrumentation requests
Connection attempt to an infection source
Sending an HTTP GET request
DNS request
Connection attempt
Sending a custom TCP request
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto microsoft_visual_cc overlay packed
Link:
https://www.filescan.io/uploads/6a6582258466da75130af8ed/reports/76005ac1-4786-49d8-8018-5091bf17f9e1/overview
Verdict:
Malicious
Labled as:
Yogi.Generic
Link:
https://www.hybrid-analysis.com/sample/63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-26T01:38:00Z UTC
Last seen:
2026-07-27T19:35:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/4147be13-dbfb-454a-aaa2-ed7974b0ce96
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/450e0227f0118633049d3c4f1e79fafc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645/
Threat name:
Win64.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2026-07-26 04:15:55 UTC
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpc7t67ux27xrzdwvefvcfnun5et5456ljlnv7hmnsbfcyergzcq._file
Verdict:
malicious
Label(s):
AnimateClipper
Create hunting rule
Link:
https://reports.threatray.com/8806c005-5c84-490e-ade4-b5351f1f47ba
Similar samples:
2478460a3ade65fbf3fa284cce3f7056c275a6e74ebb21ac554267c11dae941f
AnimateClipper
352944118ad77aea5df1707fbbb541ae7b47421f05f148512d074a108097d0a8
AnimateClipper
59eb2fad261dc13a1e9bfab3a57cd51a4841f82787130202ff348bbaf2c6409d
AnimateClipper
63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645
AnimateClipper
99dc1ea286648ec882d71ab5071e3072c702e5170770843177807179c63f4593
AnimateClipper
bcee095afc805eb5f164059598f97b5b01d1015afb496b19c640a4d01766765c
AnimateClipper
c1d77fd1e31a3470a9b59ec148fd295dcd630fd24fda16f7460ec67eaf0f1c6a
AnimateClipper
c4a41e9127dc4cd50d2cd11e98013ba59b12d853f5d5732686a2c3bdb1370a98
AnimateClipper
Result
Malware family:
animateclipper
Create hunting rule
Score:
  10/10
Tags:
family:animateclipper clipper stealer
Link:
https://tria.ge/reports/260726-d9k3lsygke/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Detects AnimateClipper
Family: AnimateClipper
Unpacked files
SH256 hash:
63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645
MD5 hash:
450e0227f0118633049d3c4f1e79fafc
SHA1 hash:
53de9d6e3d7816d949aa1adcb479f73367da8cc2
Link:
https://www.unpac.me/results/256aca0d-794b-44c5-b3fe-9688ff8065ba/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/63c5f9fbf4be/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

AnimateClipper

Executable exe 63c5f9fbf4bebf78e476a90b5115b46f493ef3be5a56dafcec6c825160913645

(this sample)

  
Dropped by
Remus
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3891634/
Cape
Cape
https://www.capesandbox.com/analysis/76203/

Comments