Medium 5 Hunt LeadsIOCs AnimateClipper Efimer CryptoBandit ReversingLabs

These Clippers Swap Your Crypto Address for a Lookalike

ReversingLabs details AnimateClipper (ZigClipper) and Efimer, clippers that replace pasted wallet addresses with attacker addresses, Efimer matching the first or last characters to evade a glance.

ThreatRoundup · Oct 31, 2026 · 20 min read

Copy a crypto wallet address, paste it, and the address that lands may not be the one you copied. ReversingLabs researcher Zaria Vuksan walks through two families that do exactly that, AnimateClipper and Efimer, in a new Threat Researcher’s Notebook. Efimer even picks a replacement address whose first or last few characters match yours, so a quick glance won’t catch the swap.

For defenders

AnimateClipper (also called ZigClipper): first seen in January 2026, named after the Zig compiler used for its payloads or droppers. It watches the clipboard for wallet-shaped strings, works out which network the address belongs to, and swaps in an attacker address on the same network (T1115 (Clipboard Data)). It arrives through fake software installers, ClickFix pages and bundles with infostealers.

Efimer: an older family that ReversingLabs links to CryptoBandit, which Microsoft wrote about in June, through shared address-matching code, wallets, C2 and file layout. It matches the first one to three characters of some address types and the last one to three of others, and also grabs clipboard contents and screenshots (T1113 (Screen Capture)). It’s built as PyInstaller executables with PyArmor-protected code, an XOR-encrypted payload and obfuscated JavaScript, quits when it spots analysis tools (T1497 (Virtualization/Sandbox Evasion)), and talks to .onion C2 over Tor on a fixed schedule (T1090.003 (Proxy: Multi-hop Proxy)). New builds come out hourly, about 24 fresh samples a day, so hash blocking alone won’t keep up. Lures include fake “VisionCraft Labs” and “IIPaint” software, a fake Composer for PHP, phishing and fake torrent sites.

Status: ReversingLabs says both families went quiet shortly after its research. It published C2 hosts, download URLs and SHA-256 hashes, no YARA specific to these families, and no wallet addresses.

Network

celebration-internet[.]cc
lb.propertyfind[.]cc
static.quorashift[.]cc
kffd3.vexlatech[.]cc
kkc.vogueatelier[.]cc
tuasesoriadigital[.]es
hasansunnah[.]xyz
voedseltuinijplein[.]nl
webenvysolutions[.]com
167.233.30[.]202
91.92.47[.]8
64.89.161[.]122

Files

default.dat / default.dat.exe
composer.dat
visioncraft_ai.exe
quis.exe
nvd_driver_dll.exe

What it means for you

A clipper doesn’t break into your wallet. It waits for you to send money, then quietly swaps the destination address you pasted for the attacker’s, so you pay them yourself. Crypto payments can’t be reversed, so once it’s sent, it’s gone. These programs usually arrive with a “free” or cracked app, a fake AI tool, or a web page telling you to paste a command to fix something.

Do this now

Before you send crypto, compare the pasted address with the original, character by character at both the start and the end, not just the first few.
For large transfers, send a small test amount first and confirm it arrived.
If a pasted address ever differs from what you copied, stop using that computer for crypto and scan it with up-to-date security software, or wipe it.
Never paste commands from a web page into Windows, and install software only from its maker’s official site.

Source article: Threat Researcher’s Notebook: How Attackers Redirect Crypto Payments
Publisher: ReversingLabs (Zaria Vuksan)
Published: October 30, 2026
URL: https://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments

Executive Summary

ReversingLabs documents two Windows cryptocurrency clipper families that silently replace wallet addresses on the clipboard: AnimateClipper, also reported as ZigClipper (after the Zig compiler used for its payloads or droppers), first seen in January 2026, and Efimer, which ReversingLabs assesses as the likely ancestor of the CryptoBandit clipper Microsoft described in June 2026, based on shared address-matching code, target wallets, C2, file structure and anti-analysis features. No threat actor is named. AnimateClipper spreads through fake software installers, ClickFix lures and bundling with infostealers; Efimer through phishing email, fake torrent sites, fake software (lures such as “VisionCraft Labs”, “IIPaint Software” and a fake “Composer Dependency Manager for PHP”) and fake-error ClickFix pages. Payloads are pulled from compromised or attacker-controlled web servers (for example default.dat, composer.dat, quis.exe, nvd_driver_dll.exe); Efimer is delivered as PyInstaller executables with PyArmor-protected modules, an XOR-encrypted payload and obfuscated JavaScript, persists via a scheduled task, exits when analysis tooling is present, rebuilds hourly (about 24 new samples a day) and beacons on a fixed interval over Tor to .onion C2 that can issue commands. Once running, both families monitor the clipboard for wallet-shaped strings, identify the network from the address format and substitute an attacker address on the same network, with Efimer matching the first or last one to three characters of the victim’s address to defeat casual checks; both can also exfiltrate clipboard contents, and Efimer takes screenshots. The objective is direct theft of cryptocurrency payments, which are irreversible. Both families were reported inactive shortly after the research. Hunt leads, false positive expectations and indicators are detailed below; the source publishes no family-specific YARA rule.

ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Collection → Command and Control → Impact

Hunt Lead Grid

Hunt Lead Level	Hunt Lead Name	ATT&CK	Risk of False Positives
1 (Junior)	Clipper C2 and Payload Host Sweep	T1105 (Ingress Tool Transfer), T1071.001 (Application Layer Protocol: Web Protocols)	Low. The C2 hostnames and onion addresses are attacker-only; several payload hosts are compromised legitimate sites, so those hits anchor on the full payload path, not the bare domain.
1 (Junior)	AnimateClipper and Efimer Hash Sweep	T1204.002 (User Execution: Malicious File)	Low. The SHA-256 values are specific malware builds; the only caveat is coverage, since Efimer rebuilds hourly and old hashes miss new samples.
2 (Pro)	Script Host Pulling DAT and EXE Payloads After a Paste	T1204.004 (User Execution: Malicious Copy and Paste), T1105 (Ingress Tool Transfer)	Medium. Admin scripts and installers download files with PowerShell, but rarely a .dat file that is then executed or renamed to .exe, launched from the Run dialog; the rule anchors on that origin and file pattern.
2 (Pro)	Tor Beacons From a User Workstation	T1090.003 (Proxy: Multi-hop Proxy)	Medium. Tor Browser users and some privacy tools legitimately use Tor; the rule anchors on Tor traffic from a process that is not a known Tor client, at a fixed interval, from a user-writable path.
3 (Elite)	Hidden Process Polling the Clipboard and Rewriting Wallet Addresses	T1115 (Clipboard Data), T1113 (Screen Capture)	High. Clipboard managers, remote-desktop tools and password managers all read and write the clipboard; this needs API-level telemetry, a strict allowlist of signed image paths and correlation with unsigned or PyInstaller-packed binaries in user-writable folders.

Clipper C2 and Payload Host Sweep

ReversingLabs published the infrastructure for both families. AnimateClipper C2 runs on celebration-internet[.]cc, lb.propertyfind[.]cc, static.quorashift[.]cc, kffd3.vexlatech[.]cc and kkc.vogueatelier[.]cc, with payloads served from URLs such as hxxps://kupunasvolpiano[.]com/g/static/s/cinzel/v23/Taskforce.exe, hxxp://91.92.47[.]8/quis.exe, hxxps://muaklekcoop[.]com/js/quis.exe, hxxps://hindustanagency[.]com/666.exe, hxxps://thepullmanfolkestone[.]com/ppisondeers.exe, hxxps://peniclean[.]com/nvd_driver_dll.exe, hxxps://microlsireqjn[.]com/nvd_driver_dll.exe, hxxps://peowlakjew[.]com/clean_driver_dll.exe, hxxp://64.89.161[.]122/SW.exe, hxxps://cim-kolea[.]com/3.exe and hxxps://wantsellonline[.]com/1.exe. Efimer payloads came from tuasesoriadigital[.]es/default.dat, hasansunnah[.]xyz/composer.dat, voedseltuinijplein[.]nl/composer.dat, webenvysolutions[.]com/composer.php and 167.233.30[.]202/files/ (swfe60.exe, 9je7p2.exe, xgc6jp.exe, wjpr1q.exe), and its C2 is on four onion paths: gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onion/route.php, hek5ensy7wqqls2cafflihs7sdqr4dwxux47vp3k7pgffeasxsfeeyid[.]onion/recvf.php and /route.php, and swjxev2rvxfivi2wvkxre5vaxkjeepxzxva4u4ydm2qbkbakh6wnyead[.]onion/core/repla.php. The detection logic is a retrospective match of the clearnet hostnames, IPs and full URLs in DNS, proxy and firewall logs, and of the onion hostnames in proxy logs, EDR command lines and any Tor-aware network sensor.

Sweep from January 1, 2026, when AnimateClipper first appeared. Onion addresses won’t show up in normal DNS, so look for them in proxy CONNECT logs, process command lines and memory or file string scans during investigations. Many payload hosts look like hacked small-business sites (a Spanish digital agency, a Dutch community garden, a PHP-themed lure), so match the payload path and don’t blanket-block the domain if your users need it. Because both families were reported inactive, hits are most valuable as evidence of past infection: any match should start a host investigation and a review of the user’s recent crypto transactions.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer), T1071.001 (Application Layer Protocol: Web Protocols)

Sources: “Threat Researcher’s Notebook: How Attackers Redirect Crypto Payments”, ReversingLabs, Oct. 30, 2026, https://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments (source article)

AnimateClipper and Efimer Hash Sweep

The source lists SHA-256 values for 26 AnimateClipper samples collected in September 2026, 23 Efimer PyInstaller executables built during a single 24-hour period, 23 PyArmor runtime DLLs shipped with Efimer, three obfuscated Efimer JavaScript payloads and the Efimer scheduled task XML used for persistence. The detection logic is a retrospective match of all of these in EDR file telemetry, email and web gateway attachment and download logs, and file-integrity or software inventory data, with the task XML hash also checked against files under C:\Windows\System32\Tasks.

Run the sweep back to January 2026. Expect limited coverage: ReversingLabs notes Efimer generated a new build roughly every hour, so these hashes are a sample, not a complete set; treat any hit as high confidence and any miss as uninformative. The PyArmor DLL hashes belong to Efimer’s protected modules, so they catch installs even when the outer PyInstaller executable has been rebuilt. Hash blocking on its own is the wrong preventive control against an hourly-rebuilt family; use it to find past infections and lean on the behavioral leads for prevention. Any hit should trigger host isolation and a review of crypto transactions made from that machine.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Execution → T1204.002 (User Execution: Malicious File); Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task)

Script Host Pulling DAT and EXE Payloads After a Paste

Both families use ClickFix: a page shows a fake error or verification step and has the victim paste a command, and ReversingLabs specifically warns about sites asking users to verify themselves with PowerShell. The payloads it lists follow a recognizable pattern: Efimer files named default.dat, default.dat.exe and composer.dat, plus visioncraft_ai.exe for the fake AI-tool lure, and AnimateClipper executables with driver-like or random names (nvd_driver_dll.exe, clean_driver_dll.exe, quis.exe, Taskforce.exe, 1.exe, 3.exe), fetched over plain HTTP or HTTPS from web paths that don’t belong to software vendors. The detection logic is a process and file rule: powershell.exe, cmd.exe, mshta.exe or curl.exe launched from explorer.exe via the Run dialog (with a matching new RunMRU value) that downloads a .dat or .exe file to a user-writable folder, followed within minutes by execution of that file or a rename from .dat to .exe.

Use EDR process, file and registry telemetry plus proxy logs for the download URL. Sweep 90 days. Scope out software deployment tools by their signed parent images and approved distribution hosts, not by script-host name. Blocking powershell.exe for all users is usually the wrong control and breaks administration; application control or ASR rules that stop script hosts from launching downloaded executables in user folders are better. ReversingLabs links a separate generic ClickFix HTML hunting YARA rule in its rule repository (HTML.Hunting.ClickFix.yara), which is not specific to these families and is not reproduced here. A confirmed paste-download-execute chain means the user ran attacker code; escalate it.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1204.004 (User Execution: Malicious Copy and Paste); Command and Control → T1105 (Ingress Tool Transfer)

Tor Beacons From a User Workstation

Efimer talks to its C2 over Tor to .onion addresses on a fixed interval, chosen to keep network noise down, and accepts commands back; ReversingLabs ties the same C2 and file structure to CryptoBandit, which Microsoft describes as Tor-based. A PyInstaller executable in a user folder that opens Tor connections on a steady cadence is unusual on a business workstation. The detection logic is a network rule for connections to known Tor entry relays or Tor-default ports (9001, 9030, 9050, 9150) from processes that are not an approved Tor client, enriched by the initiating image path (user-writable folders such as AppData or Temp), the binary’s packing (PyInstaller) and a regular beacon interval across hours.

Use firewall or NetFlow data matched against a regularly refreshed public Tor relay list, joined with EDR network events that carry the process and path. Sweep 90 days and baseline: where Tor is banned by policy, any hit is worth triage; where it is allowed, allowlist Tor Browser by its signed path and focus on everything else. Blocking all Tor relays at the perimeter is a reasonable control in many enterprises, but do it alongside detection, because a block alone hides which hosts are infected. The interval analysis needs stateful counting over time, which is why this sits at Pro. Hits from an unknown binary should be treated as infected hosts.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1090.003 (Proxy: Multi-hop Proxy)

Hidden Process Polling the Clipboard and Rewriting Wallet Addresses

The core behavior of both families is clipboard surveillance and substitution. They poll the clipboard for strings that look like wallet addresses; Efimer, for example, recognizes Ethereum addresses by a leading 0x and a 40 to 44 character length and has similar logic for Bitcoin and Monero. They identify the network from the format and write back an attacker address for the same network, with Efimer choosing a replacement that shares the first or last one to three characters with the victim’s address. Both can also exfiltrate clipboard contents, and Efimer captures screenshots. The detection logic correlates a process with no visible window, running from a user-writable path and unsigned or PyInstaller-packed, that repeatedly opens and reads the clipboard (OpenClipboard, GetClipboardData) and writes to it (SetClipboardData, EmptyClipboard) shortly after a read, especially when the written value differs from the read one but is still wallet-shaped, plus periodic screen captures from the same process.

This requires EDR or API-monitoring telemetry that records clipboard API calls, which many tools do not log by default; where it isn’t available, hunt for the surrounding traits (unsigned PyInstaller binary in AppData or Temp, persistence via a scheduled task, Tor traffic) and confirm with memory analysis. Build a strict allowlist of clipboard managers, remote-desktop clients, password managers and accessibility tools by signed image path. Prioritize finance, treasury and crypto-handling users. Telling users to “check the first few characters” is the wrong control here, because Efimer is built to beat exactly that check; train them to compare the whole address or use address books and test transactions. Because this behavior is shared by most clippers, the detection generalizes well beyond these two families. A confirmed hit is a theft risk: isolate the host and stop all crypto transfers from it until it is rebuilt.

Hunt Lead Level: 3 (Elite)

ATT&CK: Collection → T1115 (Clipboard Data), T1113 (Screen Capture); Impact → T1565.003 (Data Manipulation: Runtime Data Manipulation) (our mapping for the in-memory address swap; the source gives no ATT&CK IDs)

Hash Appendix

AnimateClipper (ZigClipper) samples

SHA-256 values come from the source article (samples collected September 2026); the source gives no file names, MD5 or SHA-1 values, and AlienVault OTX and VirusTotal were not queried in this run.

MD5s
(not available)  # AnimateClipper samples 1-26 -> source lists SHA-256 only

SHA1s
(not available)  # AnimateClipper samples 1-26 -> source lists SHA-256 only

SHA256s
030edb0266cbb6f7b998461096304bcf345a44ceb67ac16ae88a7839a539f271  # AnimateClipper sample 1 -> clipper payload (file name not given)
12f14940567788a509fbb700948eb6f9eec1f311aa456ba6f6dba661c9dcc0da  # AnimateClipper sample 2 -> clipper payload (file name not given)
17b2fa8686141b4f5d2e7bef36e992caa4ca8763827976d3fa8a45dc9a6eb4de  # AnimateClipper sample 3 -> clipper payload (file name not given)
1943d401836d4f87ce42ab82e40d695a9c507bdb116714bdf7315d4a58af048c  # AnimateClipper sample 4 -> clipper payload (file name not given)
3d3b91df2fdac41a8a455397e1037daade8c399286b2e1ae067eb1941c1a3113  # AnimateClipper sample 5 -> clipper payload (file name not given)
3de86edbdec211a07a456e90f8962bf2e9e68fc8d73580b18d03edc43d32a64d  # AnimateClipper sample 6 -> clipper payload (file name not given)
449891824f9dff1e6160ef818a0f0045d64d7ef8551dd5f19f421702a4813a42  # AnimateClipper sample 7 -> clipper payload (file name not given)
50f10f19c0c10cdbcd11d9d8498c9ab4805f500cc65d6bb2404235090eb595db  # AnimateClipper sample 8 -> clipper payload (file name not given)
53bdd0bfed83d62fe52cbb1b917d8f9b80a67ab0ea98fbeb9ce5c863989729eb  # AnimateClipper sample 9 -> clipper payload (file name not given)
55563d2f91b11bb887231475f0216cb84f6e62fda0cd5adbfbd813ca27b1ed1d  # AnimateClipper sample 10 -> clipper payload (file name not given)
57ea5692ac1f837bf97cb0c1c0fd4a06c37bb8d7a64dab3a544869b1363ab822  # AnimateClipper sample 11 -> clipper payload (file name not given)
72f807c8536ef841f4854d955e7f97120b13faad909de5527e6c2e8be563eb97  # AnimateClipper sample 12 -> clipper payload (file name not given)
804778b6ef86bb18eb82b3d639d8caaf6de15509f863ed5dd6e4a1bb8bbf122e  # AnimateClipper sample 13 -> clipper payload (file name not given)
80abc3f7826a2bcef4b1cec2ad4308fe1c154f704bb86af97902370be6872053  # AnimateClipper sample 14 -> clipper payload (file name not given)
8b34daf226e7e34393687aeed646b1b813a04d5b8127a7259704892ad50615a3  # AnimateClipper sample 15 -> clipper payload (file name not given)
a26253ecc8e5d3e30c42500dddf9fa5fd8be493667059093fd79fac04b312a4d  # AnimateClipper sample 16 -> clipper payload (file name not given)
a6a7312ffdb4baf3713dc3c191be57e0189c814590eebd72e08f5cae632fffc1  # AnimateClipper sample 17 -> clipper payload (file name not given)
aa0fb52cbe993793cef2cc3c80c5cc0def5dc667209cce137fe7e052162db805  # AnimateClipper sample 18 -> clipper payload (file name not given)
b6f4849d1150b8e44a005bbae7478730703c544b2ca0d82d4df0d13131044bee  # AnimateClipper sample 19 -> clipper payload (file name not given)
b947bae3c1e0f3abe7e1408d0a18e38955e7f5357995b0f96c5e221493971268  # AnimateClipper sample 20 -> clipper payload (file name not given)
bb480e9c74827a1add5bcd67a7a4cdd685ee448df5558aa6ef600cd53c0b0b45  # AnimateClipper sample 21 -> clipper payload (file name not given)
c74591b3eed1fe493d3d984de84ccd82f0a481020408aca596924de78a4a8bec  # AnimateClipper sample 22 -> clipper payload (file name not given)
d6aa943e7b696141090fe55c9f5f424e97abc8b52a6b469dff0448e1cf5ad54e  # AnimateClipper sample 23 -> clipper payload (file name not given)
ea5b7f5b1b8c23e4bf84117050095b757d86496191f87428e5e4fde2d1ab778c  # AnimateClipper sample 24 -> clipper payload (file name not given)
ed3a66132044ad25b5e7f13b6fda5ccec35df0e27e3138fd294c1827164b6ede  # AnimateClipper sample 25 -> clipper payload (file name not given)
f5aeda5f14f021fc3f85fc1d4b889252277dbf3d95937e2fe5886495ba6059cc  # AnimateClipper sample 26 -> clipper payload (file name not given)

Efimer PyInstaller executables

SHA-256 values come from the source article (builds from a single 24-hour period); no file names, MD5 or SHA-1 values are given, and OTX and VirusTotal were not queried in this run.

MD5s
(not available)  # Efimer PyInstaller samples 1-23 -> source lists SHA-256 only

SHA1s
(not available)  # Efimer PyInstaller samples 1-23 -> source lists SHA-256 only

SHA256s
e46f514e456c5e27f60854e4156234e6ae8c4dd5892ddb4d2d557de02fc2cd15  # Efimer PyInstaller sample 1 -> clipper executable
bb796bb63f6985e75dbb6c1f8eb8640dee859f989f09a4a2fd9102d33918139b  # Efimer PyInstaller sample 2 -> clipper executable
3cc7dab11f0f333fad56e428efaa638ccbf7af16eb4dfc8dab2621732fb22d92  # Efimer PyInstaller sample 3 -> clipper executable
a77b9a651bd09e64215bdfc65d99fe93bff5dfa8a50748f02bf5d9b699399736  # Efimer PyInstaller sample 4 -> clipper executable
31876a3a26a0f92a001dcae2b84174bb9f47af9208f7a92b6e160b1931899b01  # Efimer PyInstaller sample 5 -> clipper executable
d91e69f6cfc7d484a6a67de2e65712e995590af17a419b0b0c1ea22de3d2f81f  # Efimer PyInstaller sample 6 -> clipper executable
47b63f2e99323a4494c3a4ebd8bba9f8a0466356d10ed4df477e046101a21c2b  # Efimer PyInstaller sample 7 -> clipper executable
2978fc4af143e194885eb6df3e92a885fd7f820dacdbffd0478be972e449523f  # Efimer PyInstaller sample 8 -> clipper executable
55f0b60af40ee8affb3184145d88b70383837fea57d2de8f52b64665d5314e6e  # Efimer PyInstaller sample 9 -> clipper executable
c7004fc843cc835a5c72630c78d1a11c052245352906e19214a439f8393a55cc  # Efimer PyInstaller sample 10 -> clipper executable
2febd77a459f7f10ecf3bf36fa42689f765a333990ced7f04ab898e0595edbb2  # Efimer PyInstaller sample 11 -> clipper executable
deb1cf717b00ddab4e32f30c29a65616dca2b7251aeb1f7fb837893d3ffe0176  # Efimer PyInstaller sample 12 -> clipper executable
892e3dee69fbd32403412137c34b784707f1e7062938501ee34dca9f8695c61a  # Efimer PyInstaller sample 13 -> clipper executable
5fa3e214842722f8dbc56499a74b3794701fd00a7c38396f9bd22c382ad73816  # Efimer PyInstaller sample 14 -> clipper executable
b6f4e866faa39925863efbd15904a5fc85a5c08b555965211cf95edc26fe42a1  # Efimer PyInstaller sample 15 -> clipper executable
d97ea10d1dbfe2a69e0d2387e8985635b20628495918abd54c4b052c0acf05b1  # Efimer PyInstaller sample 16 -> clipper executable
fee9293adc75678d15c372c03604d9622cb65259821a54ef912248c53f9d9192  # Efimer PyInstaller sample 17 -> clipper executable
40dc7440564975985476e30a20135a9de794c920b63e84aa9447af9d06efc678  # Efimer PyInstaller sample 18 -> clipper executable
bc4bfc479321f0ec2785e1488ed5421ab3f540fe55f4943748e49b1e6030fdeb  # Efimer PyInstaller sample 19 -> clipper executable
24aa10a7b03a9ae4dcfda6eab4a06e634cd7012f77fb05d95a444f7a970aec05  # Efimer PyInstaller sample 20 -> clipper executable
e77c1d3fd059fe8248e81fdfcbdc1f72c99bd208e4951203e43e16f803dabb1d  # Efimer PyInstaller sample 21 -> clipper executable
542ff833aa11374be9b2f2278eb808a4b17d754a72715bf6af0f13c1c68a9d3a  # Efimer PyInstaller sample 22 -> clipper executable
5a07da677d17aa1de19d6450bc1c183305ad85d917e20b2518a0a9d4d2c16ce8  # Efimer PyInstaller sample 23 -> clipper executable

Efimer PyArmor runtime DLLs

SHA-256 values come from the source article; no file names, MD5 or SHA-1 values are given, and OTX and VirusTotal were not queried in this run.

MD5s
(not available)  # Efimer PyArmor DLLs 1-23 -> source lists SHA-256 only

SHA1s
(not available)  # Efimer PyArmor DLLs 1-23 -> source lists SHA-256 only

SHA256s
033dd215975f5dcd61ca5f7685d8618154b674d0b9e3262549140dc66e4701d5  # Efimer PyArmor DLL 1 -> protected-module runtime
1682401b0fad7aa78a23e0b34b56257cc6add40c0d0943d2076833a29feb8e54  # Efimer PyArmor DLL 2 -> protected-module runtime
1a7127495413e5e950e7794a05ff3cf0f6d9d5c619d5b38155d7a3f653430942  # Efimer PyArmor DLL 3 -> protected-module runtime
2635bacc8347ce37b9e0fdfd8d5c496eb9e41ff4c32b7fe2608953d1cb99bcdf  # Efimer PyArmor DLL 4 -> protected-module runtime
2bac84d2f06457096fe38a402d1b0562131a6c7a651c04720fe014d88b4fe3c7  # Efimer PyArmor DLL 5 -> protected-module runtime
4ee3dc0b5f5016cd393261b2b6eb71df7b26cf1de4c16ffbdb13975566359678  # Efimer PyArmor DLL 6 -> protected-module runtime
5946108772430f963d35e9b2611471dc88fd67708fd3a6aa6876a7a8db8400bf  # Efimer PyArmor DLL 7 -> protected-module runtime
63436915dc43fd23c41152ae7e113b4b1ecc34bfd32d80a4f00454e9c8a741b5  # Efimer PyArmor DLL 8 -> protected-module runtime
66ebc94e42637cb4ad8975f19791821344a86ce2eb0fcc4b9305554c986a8e15  # Efimer PyArmor DLL 9 -> protected-module runtime
6a21b696bcf9a0b1a4f03f51df19870591a52d6182270cdc453b4b46543097b7  # Efimer PyArmor DLL 10 -> protected-module runtime
7c05584e2c3e8d53f8a171d9268054894799615fac8aacb8193948f0cbbdd4d9  # Efimer PyArmor DLL 11 -> protected-module runtime
82d3435d4f190e8d4d5cf618010b25c37653e12cd4499d18b6e52bdf5a7459dc  # Efimer PyArmor DLL 12 -> protected-module runtime
83f1d9e59c02b4828e64b94e9f618c5494341a0f30bf52552ef75c250f3847ff  # Efimer PyArmor DLL 13 -> protected-module runtime
8dfad18030c70676a14dd62e41412d324c896e6226e9ceedb2fb04f33c27a9a6  # Efimer PyArmor DLL 14 -> protected-module runtime
98a58499d8228c45f55bc5a391d1ae29c9e30fd2ecadacfff4a6c8df4064bd32  # Efimer PyArmor DLL 15 -> protected-module runtime
a177b1e813ebde8a442a52d90cb31c860d809b259d50c9608ec1fc2c076bb343  # Efimer PyArmor DLL 16 -> protected-module runtime
a2b0d4fc578e3fc73e5026fb77e2ced8049b8bb770682e3fcf5be9ff23a619b6  # Efimer PyArmor DLL 17 -> protected-module runtime
a654d127b9689f2da9d28fc3756142877f7e15264652801ae077c4887dd126fd  # Efimer PyArmor DLL 18 -> protected-module runtime
aa3b4c4cf1d2a059c233f10bc4827298522e0bc1a66b192d4410aca6131d91ce  # Efimer PyArmor DLL 19 -> protected-module runtime
b5a1c345cfec0b35dbf81803523cdc09edeb061f6d522f43da70107d4fbb94f1  # Efimer PyArmor DLL 20 -> protected-module runtime
c3180fb60f54da6440b3fa2d2569e5966c92b0fd3c451b7be0bba0e9dd5a967c  # Efimer PyArmor DLL 21 -> protected-module runtime
dddfbdf29601425688d41711ad3748cda62b111aa03622c8174b3c09b7d4f661  # Efimer PyArmor DLL 22 -> protected-module runtime
f5b419e2adc3a2e802f13fd3c089ae183e9f8216b58be8d366721600fc314209  # Efimer PyArmor DLL 23 -> protected-module runtime

Efimer scheduled task and JavaScript payloads