# TheBoxClipper

**URL:** <https://community.emergingthreats.net/t/theboxclipper/904>\
**Category:** Rule Signatures\
**Created:** [August 29, 2023, 7:57pm UTC](https://community.emergingthreats.net/t/theboxclipper/904 "2023-08-29T19:57:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\
**Post date:** [August 29, 2023, 7:57pm UTC](https://community.emergingthreats.net/t/theboxclipper/904/1 "2023-08-29T19:57:53Z")

</div>

Hi, I decided to dedicate this rule to our good friend and researcher @James_inthe_box. He discovered the clipper and we wanted to come up with a name, so I decided))

> <https://twitter.com/James_inthe_box/status/1696566802094919995?s=20>

Apparently, the request is hardcoded in the traffic, so I have three rules, two of which are for http and one for tcp:

```auto
alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] TheBoxClipper (addbild)";flow: established, to_server; http.request_line; content: "GET /addbild/"; pcre: "/\/[a-f0-9]{32}$/R"; classtype: trojan-activity; reference: md5,6cf851bf1c9f18c57e8567ee19a1269f; reference: url,app.any.run/tasks/5e18a292-b42e-4b64-931b-be3319aadaa3; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family TheBoxClipper, created_at 2023_08_29; sid: 1; rev: 1;)

alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] TheBoxClipper (getkeys)";flow: established, to_server; stream_size: server, =, 1; stream_size: client, <, 33; dsize: < 32; content: "GET /getkeys/";content: "|0d0a0d0a|"; distance: 0; isdataat:!1, relative; classtype: trojan-activity;reference: md5,6cf851bf1c9f18c57e8567ee19a1269f;reference: url,app.any.run/tasks/5e18a292-b42e-4b64-931b-be3319aadaa3;metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family TheBoxClipper, created_at 2023_08_29;sid: 2; rev: 1;)

alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] TheBoxClipper (updatebildchange)";flow: established, to_server; http.request_line;content: "GET /updatebildchange/";pcre: "/\/[a-f0-9]{32}$/R"; classtype: trojan-activity;reference: md5,6cf851bf1c9f18c57e8567ee19a1269f;reference: url,app.any.run/tasks/5e18a292-b42e-4b64-931b-be3319aadaa3;metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family TheBoxClipper, created_at 2023_08_29;sid: 3; rev: 1;)

```

Here I checked the triggering of the rules:

> **[Analysis win.bin.zip (MD5: 62FA0B7A870EAF92F1BBFCE698D0E44C) Malicious...](https://app.any.run/tasks/54f672c7-0f9b-4848-a585-3d1729726775/)**
>
> Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

Jane (^-^)/

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [August 29, 2023, 10:09pm UTC](https://community.emergingthreats.net/t/theboxclipper/904/2 "2023-08-29T22:09:47Z")

</div>

thanks @Jane0sint ! We’ll get these in tomorrow’s release. 🥳

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [August 30, 2023, 8:58pm UTC](https://community.emergingthreats.net/t/theboxclipper/904/3 "2023-08-30T20:58:53Z")

</div>

`2047821 - ET MALWARE [ANY.RUN] TheBoxClipper (addbild)`  
`2047822 - ET MALWARE [ANY.RUN] TheBoxClipper CnC Activity (getkeys)`  
`2047823 - ET MALWARE [ANY.RUN] TheBoxClipper (updatebildchange)`