MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a3fc257581b51d9fdb30d6c9e708c47726352b3e8b75ece8e31ff1bb0d47be9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaplasClipper


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a3fc257581b51d9fdb30d6c9e708c47726352b3e8b75ece8e31ff1bb0d47be9
SHA3-384 hash: d0afa1295cf0bf5984910459700a875571d6a4b30007290bc04bcf03b57dace3529571188201d19d1c54acbd4a10aaaa
SHA1 hash: 5daa470492df076b0b21d4afe2fca419ca95fb59
MD5 hash: 29b609a2b1aeada06c5b456e64bc1e58
humanhash: lithium-artist-enemy-pasta
File name:TradingView Complete Package 2023.zip
Download: download sample
Signature LaplasClipper
Create hunting rule
File size:1'919'848 bytes
First seen:2023-01-12 19:14:43 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:wEA0oUjqQVJVtGkCd9KBl3wGWa8+2HiNJf/D6kJLwhdlcKCpz:VRjztGkSAlgTiHnWdmz
TLSH T1EA957F7770DD0E12E75817D5CE53A9BB5EB8F4731789ECE8725AD080EC9A818AC23742
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter iamdeadlyz
Tags:45-159-189-105 5-75-182-6 exe FakeTradingView file-pumped LaplasClipper vidar zip


Avatar
Iamdeadlyz
Spread via Telegram (randomly spamming the file)
Vidar Stealer C&C:
t.me/tgdatapacks -> 5.75.182.6:80
steamcommunity.com/profiles/76561199469677637 -> 78.47.172.233:80
95.217.240.6:80
LapLas Clipper C&C: 45.159.189.105:80

Intelligence

File Origin
# of uploads :
1
# of downloads :
275
Origin country :
n/a
File Archive Information

This file archive contains 23 file(s), sorted by their relevance:

File name:Japanese.ini
File size:94'046 bytes
SHA256 hash: 9077b41d743ed6af51cd9b8aedaebb6d1e0e6217825635a1aa9451994efaff0f
MD5 hash: 36d47bfae8d0d48d56b7b1feb3b317e7
MIME type:text/plain
Signature LaplasClipper
File name:Swedish.ini
File size:106'964 bytes
SHA256 hash: f1ee3b2de54ee588813a7dbffca7e7607bbb769c763cdf73ccd600e06346fe1d
MD5 hash: d0280eb9ebf7e5f9b91dc0e405bd7178
MIME type:text/plain
Signature LaplasClipper
File name:Thai.ini
File size:106'098 bytes
SHA256 hash: 172276c875a496c173b349e24f7dec66ddda24f6a424120a13de73ef5e70ba07
MD5 hash: b193d9eacf4afac3199e11b4f4cb6572
MIME type:text/plain
Signature LaplasClipper
File name:Korean.ini
File size:94'172 bytes
SHA256 hash: ad556989f6e4a683d9668e41d2d7175b7b46847c2eef26188b9075fc600d0132
MD5 hash: efae0c78be2abe2920c78b9d4785ab45
MIME type:text/plain
Signature LaplasClipper
File name:Slovak.ini
File size:111'936 bytes
SHA256 hash: b5b2f7fc1c62f1c8161ec59af79cf5e8f12cb0070264703087dcc5cb58e7352a
MD5 hash: fcba4d2df72a46575ca828c807224431
MIME type:text/plain
Signature LaplasClipper
File name:Danish.ini
File size:109'980 bytes
SHA256 hash: 59df77a75aca7c0a8574f6d4b5be5632908c4fea8634f4748e36ff6fee40e317
MD5 hash: 5f50b22de0efb245cd3b8f2fb50a6d3d
MIME type:text/plain
Signature LaplasClipper
File name:Vietnamese.ini
File size:108'398 bytes
SHA256 hash: 7b939fb24a88a01b1e45b37427dccb8a319cead04fd012136551f36b4363e887
MD5 hash: 9ee05121e1a02efeec015669d96161eb
MIME type:text/plain
Signature LaplasClipper
File name:Uzbek.ini
File size:79'716 bytes
SHA256 hash: af11b0cbdcb67ddc024272d45d098cf1da8a21661fe9f6fb7a0239d0c6684531
MD5 hash: 29dc4e77b361bbce2780610edf092861
MIME type:text/plain
Signature LaplasClipper
File name:Norwegian.ini
File size:106'850 bytes
SHA256 hash: 1c99b7b06af0d5ac5582f00447fbe04e2325e173666cba8ce2d18678f7b31e3b
MD5 hash: 5cf9c294bd9d233d95e54e198bd8b4ab
MIME type:text/plain
Signature LaplasClipper
File name:Croatian.ini
File size:107'972 bytes
SHA256 hash: 5bf2b70edb78073f3ce4fe6d809a3a25c982cb2840b8ebaf4367ebc42f16bd3e
MD5 hash: 8477123868f12632d652c6da5df683c2
MIME type:text/plain
Signature LaplasClipper
File name:Indonesian.ini
File size:108'516 bytes
SHA256 hash: 9e52e0b1f7ec39a36e2edd0231dc98865de8524a651fcf6b1b948a575e35fd0f
MD5 hash: d944d8a3551719a176db4da31733ab75
MIME type:text/plain
Signature LaplasClipper
File name:Finnish.ini
File size:109'246 bytes
SHA256 hash: eb6cd045c3899f7ca4a7ecd4e8211478720206b3e607ab21c22e164f4c684510
MD5 hash: 09abf1d7277a388b362c7c94012c9655
MIME type:text/plain
Signature LaplasClipper
File name:UyghurLatin.ini
File size:111'572 bytes
SHA256 hash: d517f3322a43292dbb241597353ad01013ee3be86d666c83d87c0eda4f56f926
MD5 hash: 98eb38cef87e8fa6e6d2619577d4265f
MIME type:text/plain
Signature LaplasClipper
File name:Kazakh.ini
File size:108'542 bytes
SHA256 hash: 1fde00989b3baeb67e6b1f8654cd2fc7216a40a4c5a5a9a64d03d47ee95e76be
MD5 hash: fe2b5687f2de60cb55629fd7f0ca9a21
MIME type:text/plain
Signature LaplasClipper
File name:English.ini
File size:109'732 bytes
SHA256 hash: 0f9d467f6bb6f682c0d1351b26038950c73720f2bfc0741ec1c7bfab2046d75f
MD5 hash: 525ce1c02ca53f9c63cb697ed3aae899
MIME type:text/plain
Signature LaplasClipper
File name:TradChinese.ini
File size:87'816 bytes
SHA256 hash: eb8fc39f2551834010f3748d81e5f842a1b4e27adb87e425b764bb9152b55cb1
MD5 hash: dc01555f89e044192a9ad584b62e41a7
MIME type:text/plain
Signature LaplasClipper
File name:Hebrew.ini
File size:100'292 bytes
SHA256 hash: 42ba655e5b635698995a588f4dd39147be867a0c4b45fd49edc65982b12b9531
MD5 hash: dbf6973ac46a0adcae8500a16cce4e48
MIME type:text/plain
Signature LaplasClipper
File name:Ukrainian.ini
File size:109'418 bytes
SHA256 hash: f1f0c46ed4c136149fd57d9cae512242a023e14dd13d7c633bb4f7bf9ed71343
MD5 hash: 9482109e20bf801180bbe11e0603c972
MIME type:text/plain
Signature LaplasClipper
File name:Kurdish.ini
File size:108'894 bytes
SHA256 hash: 94ac43cb7eb95277db44616a53b23e9174415377b4b3b98a1bdfc98d06a40a4b
MD5 hash: af61b416403963d653f5008aaba82e03
MIME type:text/plain
Signature LaplasClipper
File name:Hungarian.ini
File size:109'800 bytes
SHA256 hash: fe9997629d296908247a2e82da6c369e2ea7eb4c87b12fc7c8d3ecb3e6fc320d
MD5 hash: 7591df7fae4342cbc7a0706e1b28e87b
MIME type:text/plain
Signature LaplasClipper
File name:TradingView Complete Package 2023.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:470'762'280 bytes
SHA256 hash: c649cf9deb4accfe6df256515f9870309d5185382f2f09fd54782ae527bfc715
MD5 hash: fe19f8e15e6f57e097f6f80ef9e9ee60
De-pumped file size:609'792 bytes (Vs. original size of 470'762'280 bytes)
De-pumped SHA256 hash: e6e7c5d6f7a0054bf8b87c4ba79d6d4ca9aad3ae8bdbbfecf8cf346858c52e74
De-pumped MD5 hash: 1b8fb2723eba6a406652c22e1a0b5800
MIME type:application/x-dosexec
Signature LaplasClipper
File name:SimpChinese.ini
File size:88'182 bytes
SHA256 hash: 1bfa864f7012e64f5c1656fc5636ea29e87e2a45b5eb2c31a3b20643fdd8ad4d
MD5 hash: 7aad044a68d89d8bb5a202f8bc69d87c
MIME type:text/plain
Signature LaplasClipper
File name:Sinhala.ini
File size:108'584 bytes
SHA256 hash: b6fad3bf2adba7c77641ee1a17ff4cd9e5e9b14bac1b855346c91a286e517504
MD5 hash: 318ee9a93c4620940f88052b904f05ce
MIME type:text/plain
Signature LaplasClipper
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/1a3fc257581b51d9fdb30d6c9e708c47726352b3e8b75ece8e31ff1bb0d47be9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a3fc257581b51d9fdb30d6c9e708c47726352b3e8b75ece8e31ff1bb0d47be9/
Threat name:
Archive.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-01-12 19:15:53 UTC
File Type:
Binary (Archive)
Extracted files:
34
AV detection:
2 of 40 (5.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=di74ev2ydni5t7ntbvwj44emi5zgguvt5c3v5tuogh7rxmguppuq._file
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:vidar botnet:255 stealer
Link:
https://tria.ge/reports/230112-yh4qvsad69/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Malware Config
C2 Extraction:
https://t.me/tgdatapacks
https://steamcommunity.com/profiles/76561199469677637
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1a3fc257581b51d9fdb30d6c9e708c47726352b3e8b75ece8e31ff1bb0d47be9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaplasClipper

zip 1a3fc257581b51d9fdb30d6c9e708c47726352b3e8b75ece8e31ff1bb0d47be9

(this sample)

LaplasClipper

Executable exe bd7b6f6ef2d0adfb9b2e058fc46ad29ff1edffc648f9d7408745916bb8a2f310

LaplasClipper

Executable exe 9a2232a4a9ceef2c3fcfee0acca71d5717395aff8abd1b6b26aa3a5c266b3fae

  
Dropping
SHA256 9a2232a4a9ceef2c3fcfee0acca71d5717395aff8abd1b6b26aa3a5c266b3fae
  
Dropping
SHA256 bd7b6f6ef2d0adfb9b2e058fc46ad29ff1edffc648f9d7408745916bb8a2f310
  
Delivery method
Distributed via web download
  
Dropping
MD5 3eb2e4fc5a63f1148550e8ad8f55d56c
  
Dropping
MD5 e96fbf2c970cd9a9620f9b3de333ba07

Comments