MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5612db46770203b25b790effd1b40b2bc9bd758aadc2f870f4858d90296264f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaplasClipper


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5612db46770203b25b790effd1b40b2bc9bd758aadc2f870f4858d90296264f8
SHA3-384 hash: 42a1eea9720b2c0b495e4ae70eccb0013a2acdbb685ab6df8a91d8478e564d31c3fffe7b2c33e5ad6bd14af4944bd570
SHA1 hash: 811d785fbd22de25796a07c3513184e2bbbbca5d
MD5 hash: 48369cc873ac9f144c238eee4caa292e
humanhash: butter-music-juliet-robin
File name:SecuriteInfo.com.FileRepMalware.29060.30819
Download: download sample
Signature LaplasClipper
Create hunting rule
File size:15'422'464 bytes
First seen:2023-03-01 12:41:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f0af1292970a516afa467fdec16d6c4 (1 x LaplasClipper)
ssdeep 393216:jN8NiakXT0a0Y6dFLuX3iGAkWKogKXRF9B4/Pchmx3uQ1TtlM:ja+5sTOixwjGFX4rL
TLSH T194F633991C6E60F9D6D53D34066BFDEF76BB9AF9ACF04C34ACC81F49B18291980214D2
TrID 61.9% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
13.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
8.9% (.EXE) Win32 Executable (generic) (4505/5/1)
4.0% (.ICL) Windows Icons Library (generic) (2059/9)
4.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 68e0c4e8d0e871b2 (1 x LaplasClipper)
Reporter SecuriteInfoCom
Tags:exe LaplasClipper

Intelligence

File Origin
# of uploads :
1
# of downloads :
221
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.FileRepMalware.29060.30819
Verdict:
No threats detected
Analysis date:
2023-03-01 12:42:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/658fd2cb-4d11-472b-a41f-6d1d0d99f247

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.FileRepMalware.29060.30819.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug greyware packed
Link:
https://www.filescan.io/uploads/63ff481dbfec0852a68e2a61/reports/e1413cab-07e8-4ecb-9add-42bb940d3d39/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/5612db46770203b25b790effd1b40b2bc9bd758aadc2f870f4858d90296264f8
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c06545f5-a17a-46bb-b2df-a4da15e4a968
Result
Threat name:
Laplas Clipper
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1184866
Signature
Antivirus detection for dropped file
Hides threads from debuggers
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd or bat file
Sigma detected: Drops script at startup location
Snort IDS alert for network traffic
Tries to evade analysis by execution special instruction (VM detection)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Laplas Clipper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 817722 Sample: SecuriteInfo.com.FileRepMal... Startdate: 01/03/2023 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected Laplas Clipper 2->39 41 3 other signatures 2->41 7 SecuriteInfo.com.FileRepMalware.29060.30819.exe 5 2->7         started        11 koyajiwiy.exe 2->11         started        process3 dnsIp4 25 C:\ProgramData\hacemotig\koyajiwiy.exe, PE32 7->25 dropped 27 C:\...\koyajiwiy.exe:Zone.Identifier, ASCII 7->27 dropped 43 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->43 45 Query firmware table information (likely to detect VMs) 7->45 47 Self deletion via cmd or bat file 7->47 49 Tries to evade analysis by execution special instruction (VM detection) 7->49 14 koyajiwiy.exe 7->14         started        18 cmd.exe 1 7->18         started        31 nerf-0148-unknown.guru 11->31 51 Hides threads from debuggers 11->51 file5 signatures6 process7 dnsIp8 33 nerf-0148-unknown.guru 79.137.195.205, 49722, 49723, 80 PSKSET-ASRU Russian Federation 14->33 53 Antivirus detection for dropped file 14->53 55 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 14->55 57 Query firmware table information (likely to detect VMs) 14->57 63 2 other signatures 14->63 59 Uses ping.exe to sleep 18->59 61 Uses ping.exe to check the status of other devices and networks 18->61 20 PING.EXE 1 18->20         started        23 conhost.exe 18->23         started        signatures9 process10 dnsIp11 29 127.0.0.1 unknown unknown 20->29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5612db46770203b25b790effd1b40b2bc9bd758aadc2f870f4858d90296264f8/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-03-01 00:56:45 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
13 of 25 (52.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kyjnwrtxaib3ew3zb375dnalfpe325mkvxbpq4huqwgzaklcmt4a._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230301-pxcfgsgb82/
Behaviour
Suspicious use of WriteProcessMemory
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Enumerates physical storage devices
Suspicious use of NtSetInformationThreadHideFromDebugger
Checks computer location settings
Deletes itself
Drops startup file
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
85c9079bbe84b928c127abe3d16f057514bd06836ab2cb68e83b5762b9d3598f
MD5 hash:
b2844523c2b9360e641e562d5d96e0d7
SHA1 hash:
2ed214ae5a9635095243cacea181ef59df139697
Link:
https://www.unpac.me/results/add9cd0a-9bc2-4ead-a65e-49a4dade0482/
SH256 hash:
5612db46770203b25b790effd1b40b2bc9bd758aadc2f870f4858d90296264f8
MD5 hash:
48369cc873ac9f144c238eee4caa292e
SHA1 hash:
811d785fbd22de25796a07c3513184e2bbbbca5d
Link:
https://www.unpac.me/results/add9cd0a-9bc2-4ead-a65e-49a4dade0482/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5612db46770203b25b790effd1b40b2bc9bd758aadc2f870f4858d90296264f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaplasClipper

Executable exe 5612db46770203b25b790effd1b40b2bc9bd758aadc2f870f4858d90296264f8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2554064/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2545852/

Comments