unclassified-pe32-clipper
Overview
Windows PE32 x86 infostealer / clipboard clipper compiled with MSVC C++ and distributed via the gcleaner multi-payload infrastructure. First observed May 2026 (f936b99e). Replaces cryptocurrency addresses copied to the clipboard with attacker-controlled wallets and exfiltrates victim activity (geolocation, address replacements, startup events) to a hardcoded Telegram bot via the Telegram Bot API. Uses nlohmann/json v3.11.3 for payload construction and the C++ <regex> engine for address validation.
Build Stack
- Toolchain: Visual Studio 2022 (MSVC 14.44), C++17, Windows SDK 10.0 ^[raw/analyses/f936b99e/exiftool.json:18]
- Architecture: PE32, Intel 80386, Windows GUI subsystem ^[raw/analyses/f936b99e/file.txt]
- Sections: 5 (
.text,.rdata,.data,.fptable,.reloc) ^[raw/analyses/f936b99e/pefile.txt:78-176] - Dependencies: nlohmann/json v3.11.3 (single-header library) ^[raw/analyses/f936b99e/strings.txt:274]
- Signing: None ^[raw/analyses/f936b99e/rabin2-info.txt:27]
- Packing / anti-analysis: None. Clean IAT, no packed sections, no anti-VM or anti-debug strings ^[raw/analyses/f936b99e/binwalk.txt, raw/analyses/f936b99e/strings.txt]
Deployment / TTPs
| Technique | ID | Evidence |
|---|---|---|
| Input Capture: Clipboard Data | T1115 | OpenClipboard, GetClipboardData, SetClipboardData; 14-coin regex replacement ^[raw/analyses/f936b99e/strings.txt:117-148] |
| Exfiltration Over Web Service | T1567 | Telegram Bot API HTTPS POST ^[raw/analyses/f936b99e/strings.txt:151-153] |
| System Location Discovery | T1614 | ipapi.co JSON geolocation ^[raw/analyses/f936b99e/strings.txt:166-170] |
| Boot or Logon Autostart Execution: Registry Run Keys | T1547.001 | HostResolverSU under ...CurrentVersion\Run ^[raw/analyses/f936b99e/strings.txt:164-165] |
| Masquerading | T1036.005 | Filename Google-Updater.exe ^[raw/analyses/f936b99e/strings.txt:163] |
| Data from Local System | T1005 | Clipboard enumeration for wallet addresses ^[raw/analyses/f936b99e/strings.txt:117-148] |
| Application Layer Protocol: Web Protocols | T1071.001 | WinHTTP HTTPS to Telegram API ^[raw/analyses/f936b99e/pefile.txt:239-247] |
Capabilities
clipboard-hijack-cryptocurrency-registry-run-persistence-telegram-bot-exfiltration-geolocation-ipapi-co-14-coin-address-regex-coverage-nlohmann-json-payload-serialization-google-updater-masquerade-msvc-cpp-runtime-dependency-winhttp-ssl-https-post-marker-file-first-run-gating-json-status-reporting
Notable Analyses
- raw/analyses/f936b99e/report.md —
f936b99e, MSVC 14.44 x86 PE32, full static deep-dive; no CAPE detonation available
Related Entities
- gcleaner — distribution infrastructure; this sample transits via the gcleaner network but the build stack is unrelated to gcleaner's Delphi / .NET droppers
- maskgramstealer — MinGW-w64 PE64 clipper with Telegram C2 and wallet-seed regex; different build
- unclassified-pe64-clipper — static-only MinGW x64 clipper; now merged into maskgramstealer
- dolphin — Rust-based RAT/clipper with Telegram C2 and browser/wallet injection; higher complexity