MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 b02a04e65ae9453f1c3bc5fcfd47686be2fb8b8f978c3ec29a0c6749106ed4f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
LaplasClipper
Vendor detections: 16
| SHA256 hash: | b02a04e65ae9453f1c3bc5fcfd47686be2fb8b8f978c3ec29a0c6749106ed4f7 |
|---|---|
| SHA3-384 hash: | 190a49d03e56df7d004e1b8f2d0a5e66884f77dccd817b1a11f7d804f4a1f8f84ce846e49b6b9513fae9b12d03d94830 |
| SHA1 hash: | f006637ba0718ecf52b1bff5dbb8292dba7f3809 |
| MD5 hash: | 41324a44f3c3b6a06b7acb27c24cb8be |
| humanhash: | pluto-oregon-wyoming-uncle |
| File name: | file.exe |
| Download: | download sample |
| Signature | LaplasClipper |
| File size: | 869'224 bytes |
| First seen: | 2023-06-20 06:06:11 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d3bef53bd3b1af06f068902986513bdf (2 x RedLineStealer, 1 x LaplasClipper, 1 x CoinMiner) |
| ssdeep | 12288:AVkLJo17O5rRfZZExSnCTWM/VFtwIHx7xcUAH5b1wOe1H47l+6cw9t:AYJo17WrRfZZEKC/VFBR5Oe1H406Zj |
| Threatray | 166 similar samples on MalwareBazaar |
| TLSH | T1A3058C1125D1923AFC670C765E57FF27A62965320B0204EBF7D32B2A5F20CD06639E5B |
| TrID | 52.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 17.7% (.EXE) Win64 Executable (generic) (10523/12/4) 8.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.5% (.EXE) Win32 Executable (generic) (4505/5/1) 3.4% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | exe LaplasClipper |
Intelligence
File Origin
# of uploads :
1
# of downloads :
245
Origin country :
NLVendor Threat Intelligence
Malware family:
redline
ID:
1
File name:
file.exe
Verdict:
Malicious activity
Analysis date:
2023-06-20 06:19:40 UTC
Tags:
rat redline laplasclipper
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RedLine
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Searching for the window
Сreating synchronization primitives
DNS request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware lolbin overlay packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Verdict:
Malicious
Result
Threat name:
RedLine
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Writes to foreign memory regions
Yara detected RedLine Stealer
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Sonbokli
Status:
Malicious
First seen:
2023-06-20 06:07:10 UTC
File Type:
PE (Exe)
AV detection:
17 of 24 (70.83%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 156 additional samples on MalwareBazaar
Result
Malware family:
redline
Score:
10/10
Tags:
family:laplas family:redline botnet:1 clipper infostealer persistence spyware stealer
Behaviour
GoLang User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Executes dropped EXE
Downloads MZ/PE file
Laplas Clipper
RedLine
Malware Config
C2 Extraction:
95.216.249.153:81
http://45.159.189.105
http://45.159.189.105
Unpacked files
SH256 hash:
29c4974e889cf5cf9b122797f6d7117f6f7c428ac6765d21d15dfed8377ccb2e
MD5 hash:
c81df8075edc0d947d513f23523aebab
SHA1 hash:
d3737be41828b33b1f2853dac432a0b2efc04ae8
SH256 hash:
e84894c7825d8349ad37d6db5beeb3a165f245281b69073bb648169c71364398
MD5 hash:
f2f16c8874a649bb360ede6180e9b08a
SHA1 hash:
0415ab2c51ec6a2e7ac533b24108238875031e75
Detections:
redline
Parent samples :
69f24003a768ac6451b4bac285475486d27c39723f474e3b8a19c61ceb732838
91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee
db78b5b857378304d5d72a826a2f1e261a71791eda971bf952cbd8182bbc62bd
0e59fafb2de30f5fa5b6cce425f40115180b373592e1a201702742a6e8f21cc9
b02a04e65ae9453f1c3bc5fcfd47686be2fb8b8f978c3ec29a0c6749106ed4f7
91c807a3b304b61e268d884f3310e7b4c0cd74400c95c48ff7bc6ab6150282ee
db78b5b857378304d5d72a826a2f1e261a71791eda971bf952cbd8182bbc62bd
0e59fafb2de30f5fa5b6cce425f40115180b373592e1a201702742a6e8f21cc9
b02a04e65ae9453f1c3bc5fcfd47686be2fb8b8f978c3ec29a0c6749106ed4f7
SH256 hash:
b02a04e65ae9453f1c3bc5fcfd47686be2fb8b8f978c3ec29a0c6749106ed4f7
MD5 hash:
41324a44f3c3b6a06b7acb27c24cb8be
SHA1 hash:
f006637ba0718ecf52b1bff5dbb8292dba7f3809
Malware family:
RedLine.E
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Redline
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | INDICATOR_EXE_Packed_ConfuserEx |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with ConfuserEx Mod |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RawPaste_URL |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables (downlaoders) containing URLs to raw contents of a paste |
| Rule name: | MALWARE_Win_RedLine |
|---|---|
| Author: | ditekSHen |
| Description: | Detects RedLine infostealer |
| Rule name: | pe_imphash |
|---|
| Rule name: | redline_stealer_1 |
|---|---|
| Author: | Nikolaos 'n0t' Totosis |
| Description: | RedLine Stealer Payload |
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.