MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfc46f8cf562e926b9be8f15ee03bd2c632b070cc872789f50fa4d10ad994c46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaplasClipper


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cfc46f8cf562e926b9be8f15ee03bd2c632b070cc872789f50fa4d10ad994c46
SHA3-384 hash: 214a5f904fe64c70ad2a736e5813997ae35fc66db63df82cf707070c8ec3829e0cd1bf6fc0ee3de52e230e67069a0668
SHA1 hash: 1c57ad1dfbcf567675ec5f6c90e29b5e1bd17914
MD5 hash: ecaf7c9a9a0a5e54c05420d35645efd3
humanhash: pizza-triple-california-sixteen
File name:ecaf7c9a9a0a5e54c05420d35645efd3.exe
Download: download sample
Signature LaplasClipper
Create hunting rule
File size:76'800 bytes
First seen:2022-12-21 17:53:21 UTC
Last seen:2022-12-21 19:29:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f0a11f052b63318c101a03737dcad9a3 (1 x LaplasClipper)
ssdeep 1536:46Tt2NDAyoSlwGYXigEgw6oYvVFbTe1/bZ1XetuT/NztKqd1WUDJaLemNqZB:RTt2NDAy9lwGYXi/6oWVF0DXXeyNhrHu
TLSH T110737C33B6C684B0E15562F1383D9BF743A8E435576606C373D42E7E99281E32EB2C96
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe LaplasClipper

Intelligence

File Origin
# of uploads :
2
# of downloads :
180
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ecaf7c9a9a0a5e54c05420d35645efd3.exe
Verdict:
Malicious activity
Analysis date:
2022-12-21 17:56:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f8f47ecb-eee4-401c-9227-0996a95475ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/348805/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.64413870.19292.14494.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Sending a custom TCP request
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a process from a recently created file
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
clipbanker cmd.exe greyware shell32.dll
Link:
https://www.filescan.io/uploads/63a3483c818a052f5d8dd56c/reports/669dd737-ff17-40e2-be41-7ff2440a63fa/overview
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/e12d28c4-6a85-47f5-be93-773211e2354d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1138860
Signature
Antivirus detection for URL or domain
Found stalling execution ending in API Sleep call
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 771591 Sample: BSOY9TY6ly.exe Startdate: 21/12/2022 Architecture: WINDOWS Score: 84 27 Snort IDS alert for network traffic 2->27 29 Multi AV Scanner detection for domain / URL 2->29 31 Antivirus detection for URL or domain 2->31 33 2 other signatures 2->33 7 BSOY9TY6ly.exe 3 2->7         started        10 svcupdater.exe 19 2->10         started        process3 dnsIp4 21 C:\Users\user\AppData\...\svcupdater.exe, PE32 7->21 dropped 23 C:\Users\...\svcupdater.exe:Zone.Identifier, ASCII 7->23 dropped 14 cmd.exe 1 7->14         started        25 clipper.guru 45.159.189.79, 49696, 49697, 49698 HOSTING-SOLUTIONSUS Netherlands 10->25 35 Found stalling execution ending in API Sleep call 10->35 file5 signatures6 process7 signatures8 37 Uses schtasks.exe or at.exe to add and modify task schedules 14->37 17 conhost.exe 14->17         started        19 schtasks.exe 1 14->19         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cfc46f8cf562e926b9be8f15ee03bd2c632b070cc872789f50fa4d10ad994c46/
Threat name:
Win32.Trojan.ClipBanker
Create hunting rule
Status:
Malicious
First seen:
2022-12-21 01:29:26 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
16 of 40 (40.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z7cg7dhvmlusnon6r4k64a55frrswbymzbzhrh2q7jgrblmzjrda._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221221-wgwmrafh5t/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
cfc46f8cf562e926b9be8f15ee03bd2c632b070cc872789f50fa4d10ad994c46
MD5 hash:
ecaf7c9a9a0a5e54c05420d35645efd3
SHA1 hash:
1c57ad1dfbcf567675ec5f6c90e29b5e1bd17914
Link:
https://www.unpac.me/results/a1280151-4176-44c4-b60f-eb0e80760494/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cfc46f8cf562e926b9be8f15ee03bd2c632b070cc872789f50fa4d10ad994c46

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaplasClipper

Executable exe cfc46f8cf562e926b9be8f15ee03bd2c632b070cc872789f50fa4d10ad994c46

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2469977/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/348805/

Comments