MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaplasClipper


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97
SHA3-384 hash: 06da1593776594f8d8b229bace78295802de92369c7dac5585bc4248a5089637d59453f081fec8bad2073f153dc98a12
SHA1 hash: 4c368c5beb62227a21ef3e4c119646e06fa27da3
MD5 hash: ce0f1f85a927d457599097096d857bd2
humanhash: seventeen-lactose-golf-cardinal
File name:file.exe
Download: download sample
Signature LaplasClipper
Create hunting rule
File size:250'880 bytes
First seen:2023-03-17 03:13:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4b2faf5e2157c756cf2fd31d6cfd3d44 (4 x Stop, 4 x Smoke Loader, 4 x Rhadamanthys)
ssdeep 3072:5QPbxBn1JYIYtNIGIVsng6gwBownWKotYEF8JY7FwZBHxFsLPdsfhVMAdJB:kbbotNIGIVsY7wWnn8JCFyFSQhCGJ
Threatray 2 similar samples on MalwareBazaar
TLSH T15134BF0353E56C64F52656369E2FC2F47A1EF8138E79AF5B22189B2F08B11A2C57F350
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 00124221010a0911 (1 x LaplasClipper)
Reporter Chainskilabs
Tags:exe LaplasClipper

Intelligence

File Origin
# of uploads :
1
# of downloads :
254
Origin country :
US US
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
setup.exe
Verdict:
Malicious activity
Analysis date:
2023-03-17 02:21:05 UTC
Tags:
loader smoke trojan opendir ransomware stop evasion stealer
Link:
https://app.any.run/tasks/0f9e218e-13fc-4d66-a29f-986e6fabb8ba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/374937/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Launching the default Windows debugger (dwwin.exe)
Searching for the window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6413dafbc60b3295f52b775c/reports/fc994f42-64f0-49d3-8777-70bb9ef36a1b/overview
Verdict:
Malicious
Labled as:
Mikey.Generic
Link:
https://www.hybrid-analysis.com/sample/e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/131736b8-ee82-41bf-9527-05dea100d471
Result
Threat name:
Laplas Clipper
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1195489
Signature
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Laplas Clipper
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97/
Threat name:
Win32.Trojan.BotX
Create hunting rule
Status:
Malicious
First seen:
2023-03-17 03:14:07 UTC
File Type:
PE (Exe)
Extracted files:
26
AV detection:
16 of 39 (41.03%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=47aavn5cpjpn7zkzyy644dhybeogfvittnc3vck5ystruwfup6lq._file
Verdict:
malicious
Similar samples:
4cb97044fa8325ea15b14dbf9d6ee9301b9fb0601189a0c04dac9c7358313b0a
LaplasClipper
7ea5061e9ebeb45f7ef962d1566d74fdbfdaf81cfff399d22aeb1605e2501f11
LaplasClipper
Result
Malware family:
laplas
Create hunting rule
Score:
  10/10
Tags:
family:laplas clipper persistence stealer
Link:
https://tria.ge/reports/230317-drbq8aea54/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Laplas Clipper
Malware Config
C2 Extraction:
http://45.159.189.105
Unpacked files
SH256 hash:
dbfa2baa1dfd84d8932061fc19e1a4f521e8bfd08bbde36cf598ae94c0dc4160
MD5 hash:
3e8bb8950fd7ed1899800b56298e87db
SHA1 hash:
4e5f2cfc8ad4b42d995e7784d66aa2d937470aec
Link:
https://www.unpac.me/results/d30366e9-21df-4bdb-a094-684f319c0d6c/
SH256 hash:
e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97
MD5 hash:
ce0f1f85a927d457599097096d857bd2
SHA1 hash:
4c368c5beb62227a21ef3e4c119646e06fa27da3
Link:
https://www.unpac.me/results/d30366e9-21df-4bdb-a094-684f319c0d6c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaplasClipper

Executable exe e7c00ab7a27a5edfe559c63dce0cf8091c62d5139b45ba895dc4a71a58b47f97

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2567063/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/374937/

Comments