MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c66e87a025b4ccb8f93a1540b999fabf9beb16c455cbbfd189e133ab642e83e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

LaplasClipper

Vendor detections: 13

Intelligence 13 IOCs YARA 2 File information Comments

SHA256 hash:	c66e87a025b4ccb8f93a1540b999fabf9beb16c455cbbfd189e133ab642e83e2
SHA3-384 hash:	8eec7a588b9e5aa89e28b23d961afabcc28cea513bf88166003bf5d37abaa196e8c3113972fe9d0db4f03976d5272a54
SHA1 hash:	8ac32d858e32f27cccec6a8896b234affa1873ba
MD5 hash:	ddd3ef96054200d60d04934492a3d672
humanhash:	jig-whiskey-gee-tennessee
File name:	file.exe
Download:	download sample
Signature	LaplasClipper Create hunting rule
File size:	250'880 bytes
First seen:	2023-03-17 03:17:04 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4b2faf5e2157c756cf2fd31d6cfd3d44 (4 x Stop, 4 x Smoke Loader, 4 x Rhadamanthys)
ssdeep	6144:abfmvxMcnAkScaBd5COlRbsQOGdAtqhdCJ:abfmvCcPSc8dsaNssBf
Threatray	4 similar samples on MalwareBazaar
TLSH	T1A534B003A3E57C54F52687359E6EC2F8761EB863CE79AF6B23145E2F08701A2C56E350
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	1090c0c4d44a4448 (1 x LaplasClipper)
Reporter	Chainskilabs
Tags:	exe LaplasClipper

Intelligence

File Origin

# of uploads :

# of downloads :

234

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file.exe

Verdict:

Malicious activity

Analysis date:

2023-03-17 03:18:41 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d132f944-4210-4cfa-9d57-0265be4d839a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/374938/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a process from a recently created file

Creating a process with a hidden window

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Searching for the window

Creating a file in the %AppData% subdirectories

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Sending an HTTP GET request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware lockbit mikey packed

Link:

https://www.filescan.io/uploads/6413dbebc65d1ebf04c0e145/reports/0eaf92a5-e572-470e-935d-9660dbdd25a0/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/c66e87a025b4ccb8f93a1540b999fabf9beb16c455cbbfd189e133ab642e83e2

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fb1abec2-f594-4121-9277-6f2c4d5e27a5

Result

Threat name:

Laplas Clipper

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1195490

Signature

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Laplas Clipper

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c66e87a025b4ccb8f93a1540b999fabf9beb16c455cbbfd189e133ab642e83e2/

Threat name:

Win32.Trojan.BotX

Status:

Malicious

First seen:

2023-03-17 03:18:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 39 (41.03%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yzxipibfwtglr6j2cvaltgp2x6n6wfwekxf37umj4ez2wzboqpra._file

Verdict:

malicious

LaplasClipper

7ea5061e9ebeb45f7ef962d1566d74fdbfdaf81cfff399d22aeb1605e2501f11

LaplasClipper

d4607fe27527413aa9685e2ecbce8df78b2c2538ccc5703442f7757a100c1362

LaplasClipper

e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97

LaplasClipper

Result

Malware family:

laplas

Score:

10/10

Tags:

family:laplas clipper persistence stealer

Link:

https://tria.ge/reports/230317-dtlzzaea64/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Laplas Clipper

Malware Config

C2 Extraction:

http://45.159.189.105

Unpacked files

SH256 hash:

c66e87a025b4ccb8f93a1540b999fabf9beb16c455cbbfd189e133ab642e83e2

MD5 hash:

ddd3ef96054200d60d04934492a3d672

SHA1 hash:

8ac32d858e32f27cccec6a8896b234affa1873ba

Link:

https://www.unpac.me/results/2ab0411b-8319-4f58-8a5a-cc7f1e0afac6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c66e87a025b4ccb8f93a1540b999fabf9beb16c455cbbfd189e133ab642e83e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com