🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ZigClipper


Vendor detections: 12


Intelligence 12 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f
SHA3-384 hash: 1cc766525b7f1cf0f45eefdab201814fc375c1c06e8d242f2405bab6aa55505b27568e6c604dfe0dd9c9917d857c4c8e
SHA1 hash: d035da4f55af9c977f622270ab52ee69faec1d87
MD5 hash: a7b2e65ec3aed0ff8de3788dd56c6432
humanhash: finch-mountain-juliet-kentucky
File name:Decred.exe
Download: download sample
Signature ZigClipper
Create hunting rule
File size:733'440 bytes
First seen:2026-04-24 23:14:31 UTC
Last seen:2026-04-29 17:25:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 6144:1RnRDmcvpIUIHa4t4MLWnVXyklQ1UB2vCGCFy+2fUSfciSDzClE6zip6ygCOnY:1uqI7LW/lUUB2ChQUSfci+v
Threatray 29 similar samples on MalwareBazaar
TLSH T1EEF4D4EFAB60B5E4D821ABFCA4916D0183B07DD0798142AF11C7FB2BCD78A539F09651
TrID 21.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
21.2% (.EXE) Win64 Executable (generic) (6522/11/2)
16.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
14.6% (.EXE) Win32 Executable (generic) (4504/4/1)
6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 71c4e8dce4e8d471 (1 x ZigClipper)
Reporter aachum
Tags:celebration-internet-cc dcdivas-com dropped-by-Stealc exe signed SunWukong ZigClipper

Code Signing Certificate

Organisation:King and Sons
Issuer:King and Sons Intermediate CA 3
Algorithm:sha256WithRSAEncryption
Valid from:2025-10-23T16:02:48Z
Valid to:2028-04-23T16:02:48Z
Serial number: 017e70c04c1cbe60
Thumbprint Algorithm:SHA256
Thumbprint: c404464493a398e4dddc7dc72683fd89938c0702ad38aa8fcc9aaf7758f3edb5
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
iamaachum
https://dcdivas.com/wp-includes/Text/Diff/Engine/Decred.exe

ZigClipper C2: https://celebration-internet.cc/

Intelligence

File Origin
# of uploads :
2
# of downloads :
137
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
BIGFILMS 8211 INFERNO Pack Create Epic Blockbuster Scenes.exe
Verdict:
Malicious activity
Analysis date:
2026-04-24 23:01:33 UTC
Tags:
auto generic adware advancedinstaller loader stealc stealer takemyfile clickfix delphi inno installer websocket etherhiding arch-exec
Link:
https://app.any.run/tasks/865a60e9-2be0-4d68-8997-35e8f04099a6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/63519/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ebf9af4aed15d079300b91
Tags:
injection dropper cobalt obfusc
Result
Verdict:
Clean
Maliciousness:
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-04-23T16:54:00Z UTC
Last seen:
2026-04-26T16:55:00Z UTC
Hits:
~100
Detections:
Trojan-Banker.Win32.ClipBanker.sb
Link:
https://opentip.kaspersky.com/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/97f1c479-d7b2-402e-95e3-1c93b40ee6a8
Result
Threat name:
EtherHiding
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1904526
Signature
AI detected suspicious PE digital signature
Antivirus detection for URL or domain
Found direct / indirect Syscall (likely to bypass EDR)
Found stalling execution ending in API Sleep call
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Suricata IDS alerts for network traffic
Unusual module load detection (module proxying)
Yara detected EtherHiding
Behaviour
Behavior Graph:
Download SVG
Score:
48%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f/
Verdict:
Malicious
Threat:
Trojan-Banker.Win32.ClipBanker
Link:
https://tip.neiki.dev/file/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-23 23:57:50 UTC
File Type:
PE+ (Exe)
Extracted files:
19
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7awsokssyvxwlvtkyzs7gb2ghg4twyoastjhy5pay55zxl76rfxq._file
Verdict:
malicious
Label(s):
unc_rust_clipper_001
Create hunting rule
Similar samples:
113a05106b85844a4fcc943e5b06af75bb45c22cec1e6aa30400a13e00dcfc22
ZigClipper
1713b425157a02715f62c250ab2ca039f02923be43ed8715044a99f9947c7be3
ZigClipper
2d5f7e2338ade5ae68dc82758126a60fdcecd36d44d08aded3f92df35fd7bdff
ZigClipper
bf8578b5c7d90be1668df5bc90280617891a5b2f1fa5cc94f04884cddf3e36f8
ZigClipper
cf87e503337479f15b7f9394e70269dccb351dcecf1f9d82620a8af6618bff92
ZigClipper
error
ZigClipper
f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f
ZigClipper
fe39618cf95e1aed7487364f17ebc3a727a3c1f8f68722671214bc6252045f61
ZigClipper
+ 19 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion persistence spyware trojan
Link:
https://tria.ge/reports/260424-28aggsgv7t/
Behaviour
Modifies system certificate store
Adds Run key to start application
Executes dropped EXE
Unpacked files
SH256 hash:
f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f
MD5 hash:
a7b2e65ec3aed0ff8de3788dd56c6432
SHA1 hash:
d035da4f55af9c977f622270ab52ee69faec1d87
Link:
https://www.unpac.me/results/41830c33-ba23-49eb-a74c-4003652247e7/
Malware family:
ZigCryptoStealer
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f82d272a52c5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.21
Link:
https://yomi.yoroi.company/submissions/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ZigClipper

Executable exe f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f

(this sample)

  
Link
https://tria.ge/260424-24jvcse19n/behavioral2
  
Dropped by
Stealc
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/63519/
  
URLhaus
https://urlhaus.abuse.ch/url/3831569/

Comments