MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaplasClipper


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e
SHA3-384 hash: 363efde0b9ad8b87820e8634d8bb40183c50328d998c462c70a52d1157cc3579cfe81bda4aa4d26eaba66aaa5770ce2f
SHA1 hash: 8bc18a4bd2c45211444f0d337ecbcf7cc64e799e
MD5 hash: 3e3dfebd924fec783a8edf30476fb670
humanhash: oregon-lactose-papa-kitten
File name:3e3dfebd924fec783a8edf30476fb670.exe
Download: download sample
Signature LaplasClipper
Create hunting rule
File size:1'872'384 bytes
First seen:2023-02-03 19:53:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b65d7d05727ada8b2acd168719f50dd8 (3 x RedLineStealer, 2 x Smoke Loader, 1 x LaplasClipper)
ssdeep 49152:NU3xUG0CtIfw9J20VrEbB84roN9PLuNlFIm:63YfJ0VrA84UN9SJI
Threatray 100 similar samples on MalwareBazaar
TLSH T1468523527AD1C272EA6200313530CFA3F7E6A0359EB1E113ABF54AFD5F607E157252A2
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 816a6e6a6a6a6a74 (7 x RedLineStealer, 3 x Smoke Loader, 3 x Amadey)
Reporter abuse_ch
Tags:exe LaplasClipper

Intelligence

File Origin
# of uploads :
1
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3e3dfebd924fec783a8edf30476fb670.exe
Verdict:
Malicious activity
Analysis date:
2023-02-03 20:02:07 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/496666d8-776a-41f0-9260-b536775d67fd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/360065/
Detection(s):
SecuriteInfo.com.MSIL-46.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending an HTTP GET request to an infection source
Verdict:
No Threat
Threat level:
  2/10
Confidence:
75%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63dd665d416d38777a7a7f25/reports/7243dc8b-e4ee-4377-92a1-cb13eebef9cf/overview
Verdict:
Malicious
Labled as:
Babar.Generic
Link:
https://www.hybrid-analysis.com/sample/c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Titan Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ca0a0a73-348b-4b76-9e6d-d0e927a3fc63
Result
Threat name:
Laplas Clipper
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1165499
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Laplas Clipper
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-02-03 19:54:13 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
22 of 38 (57.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=y252gt4btazrzcbsckxlo32o4q3n6bgpzcqsdqjeahpbuniwt4xa._file
Verdict:
malicious
Similar samples:
2a8e2ab611c7ea1a7c4e7b6fd50cef0a812ae4921a66d25106a039c90582ce29
LaplasClipper
58b415a4211b4ab0714cb45cfc92cc793c3f6ad8b1413c5f8320cfc77b5d2868
LaplasClipper
707e8d1989268db912cc9c2fc95c82aac61aaee789ef40aa0ccc52ae14282d5b
LaplasClipper
70f55017e476683211c4e7caea2bb4301476decb9e2608df7f7dd10ff99adc35
LaplasClipper
712c853955c56e27e3e4538978fa89018cdc5e5f56944ea0da2fc1a672adc73c
LaplasClipper
b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
LaplasClipper
b698d8d059eca17a310182cd6d73a93f812d0a879cf1da9956e28506421e8474
LaplasClipper
bcb6bcc89d544f584c97fa7f7477fa0824955716ef7e9e1fed1e143404ef0cbf
LaplasClipper
ca4028b174f018a8401ebefb72d595dad12c12a9ee7209d2fc8993c0c25f3c4d
LaplasClipper
ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262
LaplasClipper
+ 90 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230203-ymjlgsec8x/
Behaviour
GoLang User-Agent
Suspicious use of WriteProcessMemory
Adds Run key to start application
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
75e795f38ba7f689c73a3bb86ef959b5e48958aafbcdc36e582f1f6d7b7139ec
MD5 hash:
23aeddebf2e77375b20b18a801759aab
SHA1 hash:
e6b7560ff5f88a8bc79a66383e8c70cc34ca38a0
Link:
https://www.unpac.me/results/2d9a838b-a16e-4ed7-97a2-6ad0f8e7ae4b/
SH256 hash:
c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e
MD5 hash:
3e3dfebd924fec783a8edf30476fb670
SHA1 hash:
8bc18a4bd2c45211444f0d337ecbcf7cc64e799e
Link:
https://www.unpac.me/results/2d9a838b-a16e-4ed7-97a2-6ad0f8e7ae4b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c6bba34f8198/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaplasClipper

Executable exe c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2526802/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/360065/

Comments