MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca4028b174f018a8401ebefb72d595dad12c12a9ee7209d2fc8993c0c25f3c4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaplasClipper


Vendor detections: 12


Intelligence 12 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca4028b174f018a8401ebefb72d595dad12c12a9ee7209d2fc8993c0c25f3c4d
SHA3-384 hash: 90c1f178c6688d838d503256a976a7486ca5a92c508799636bac42a51b0f81a2d9eb5965e9089aa4b06fde04998cdb5d
SHA1 hash: 57234dc6e5d3089dcdd93b9c85252356bc600723
MD5 hash: ca1d298195a2c92e734016a2c3600540
humanhash: coffee-whiskey-alabama-skylark
File name:file
Download: download sample
Signature LaplasClipper
Create hunting rule
File size:4'540'416 bytes
First seen:2023-01-29 19:42:07 UTC
Last seen:2023-01-30 08:47:03 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a5e4d5c597bf44c957b77cfbf891a153 (1 x LaplasClipper, 1 x Smoke Loader)
ssdeep 98304:8/1NjNNtRm8BX3kTLZ9KztDcOgDkHrzhW8ozWyEd7Xx:8NZ28BX3a2ztDlgDkLzh4WyA
Threatray 92 similar samples on MalwareBazaar
TLSH T16C262318B6B3D0C2E9A4C8313E24C679085BEDD1CC54CA6F3ADA6F2B7AF55A100457BD
TrID 42.7% (.EXE) Win32 Executable (generic) (4505/5/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 8430d0cce8686800 (2 x Formbook, 2 x LaplasClipper, 1 x AgentTesla)
Reporter andretavare5
Tags:exe LaplasClipper


Avatar
andretavare5
Sample downloaded from https://vk.com/doc712319849_660737675?hash=OUBLQN28OwBdVDpZNcmtxL3Z8lBklQvRFIzlvtk1OHT&dl=G4YTEMZRHE4DIOI:1675021047:czpu7gZTC0EUZTXA8nszMJwUB6zMl9HpXP8PWfNXrsw&api=1&no_preview=1#gj3

Intelligence

File Origin
# of uploads :
202
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-01-29 19:43:15 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dd5d8a93-474c-48d9-a80b-da452cccd88d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/358013/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/63856/overview
Behaviour
MalwareBazaar
CallSleep
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63d6cc471c9cbf7d62543c7c/reports/2fd98959-41a5-4fc4-af2a-4523bfa44247/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Titan Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/656bc818-5358-4f24-a390-007fbd7f821a
Result
Threat name:
Laplas Clipper
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1161155
Signature
Detected unpacking (creates a PE file in dynamic memory)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Laplas Clipper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 793892 Sample: file.exe Startdate: 29/01/2023 Architecture: WINDOWS Score: 68 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected Laplas Clipper 2->23 25 Machine Learning detection for sample 2->25 6 file.exe 1 2 2->6         started        9 ntlhost.exe 2->9         started        11 ntlhost.exe 2->11         started        process3 file4 17 C:\Users\user\AppData\Roaming\...\ntlhost.exe, PE32 6->17 dropped 13 ntlhost.exe 6->13         started        process5 dnsIp6 19 178.208.87.49, 80 VDSINA-ASRU Russian Federation 13->19 27 Detected unpacking (creates a PE file in dynamic memory) 13->27 signatures7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca4028b174f018a8401ebefb72d595dad12c12a9ee7209d2fc8993c0c25f3c4d/
Threat name:
Win32.Trojan.Babar
Create hunting rule
Status:
Malicious
First seen:
2023-01-29 19:43:09 UTC
File Type:
PE (Exe)
Extracted files:
19
AV detection:
10 of 39 (25.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zjacrmlu6amkqqa6x35xfvmv3lisyevj5zzatux4rgj4bqs7hrgq._file
Verdict:
malicious
Similar samples:
20ac0c20a2ef71864092cdbcdb32bb637cf76abd2ebfc5b351a6c188b9dfd05d
LaplasClipper
2a8e2ab611c7ea1a7c4e7b6fd50cef0a812ae4921a66d25106a039c90582ce29
LaplasClipper
58b415a4211b4ab0714cb45cfc92cc793c3f6ad8b1413c5f8320cfc77b5d2868
LaplasClipper
712c853955c56e27e3e4538978fa89018cdc5e5f56944ea0da2fc1a672adc73c
LaplasClipper
a53f2bbe349eb40e02353375416cb15b0723606a9909b33f7930af9c82175fbf
LaplasClipper
b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
LaplasClipper
dc401554533938f33c0c6cf36246e4fc21dc687d2d3f2925bfa9f7d62a2c5fbe
LaplasClipper
ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262
LaplasClipper
+ 82 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/230129-ye8kmscf9z/
Behaviour
Adds Run key to start application
Unpacked files
SH256 hash:
ca4028b174f018a8401ebefb72d595dad12c12a9ee7209d2fc8993c0c25f3c4d
MD5 hash:
ca1d298195a2c92e734016a2c3600540
SHA1 hash:
57234dc6e5d3089dcdd93b9c85252356bc600723
Link:
https://www.unpac.me/results/c04d693e-136a-40ea-82b6-f1f07654ac28/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ca4028b174f0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca4028b174f018a8401ebefb72d595dad12c12a9ee7209d2fc8993c0c25f3c4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/358013/

Comments