Startup report, not just a Telegram connection
A sandboxed Windows executable attempted to send a Telegram startup message with details of its execution environment. Host records also show a Run-entry write, a logon-task command, and commands to allow inbound traffic and clear event logs. They do not demonstrate clipboard theft, message delivery or successful completion of those commands.
A Windows executable recorded in a CAPE sandbox report made a Telegram API request announcing “[CLIPPER STARTED]” and carrying details of its execution environment. The message described a “FIRST RUN” and claimed “STEALTH MODE ACTIVE.” But what did the program actually do beyond announcing itself? The records supplied to CTX Threat Intelligence give a more concrete answer than those self-descriptions.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read