MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaplasClipper


Vendor detections: 11


Intelligence 11 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262
SHA3-384 hash: f7dd74a7660ba53d0cec69b16461c95784ee3bee63d17fff305d14b6881f4dbaba8432325fb311ffeabbbdeff5ffd0fd
SHA1 hash: 0958615603ec5a321e203ce583a4f6449265d0fb
MD5 hash: db79ec986805ed620baaeed1e3329b65
humanhash: mike-uranus-fifteen-seventeen
File name:db79ec986805ed620baaeed1e3329b65.exe
Download: download sample
Signature LaplasClipper
Create hunting rule
File size:4'936'344 bytes
First seen:2023-01-27 16:56:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 168ef077e9c96aec5beeabe02a67d123 (1 x LaplasClipper, 1 x RecordBreaker)
ssdeep 98304:Jax45ZA8pV1mHGY59/KhGNz+447RFbYg9RcYRUXlf4prfjJuGTyHKPdox:JK4E8pXSTz+4wFbYSuMUXlwprbJZGHrx
Threatray 91 similar samples on MalwareBazaar
TLSH T1D036E1057E38E582F99889B3F84057E43C5607D04EA146DB3DFA6D083EF6E76405B3AA
TrID 42.7% (.EXE) Win32 Executable (generic) (4505/5/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
19.0% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 61e4cce8e8cce461 (1 x RecordBreaker, 1 x LaplasClipper)
Reporter abuse_ch
Tags:exe LaplasClipper

Intelligence

File Origin
# of uploads :
1
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
db79ec986805ed620baaeed1e3329b65.exe
Verdict:
Malicious activity
Analysis date:
2023-01-27 17:08:59 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/80f5649c-a19a-4443-85cf-659e4f9745e2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/357552/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/63503/overview
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
No Threat
Threat level:
  2/10
Confidence:
80%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/63d4025f1c9cbf7d62538847/reports/d67b8a32-6a1e-40f7-a900-cb577f1bcec8/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Titan Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9a520468-61d6-4411-b607-517d238cb786
Result
Threat name:
Laplas Clipper
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1160429
Signature
Detected unpacking (creates a PE file in dynamic memory)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Laplas Clipper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 793253 Sample: XNeM8L3pxo.exe Startdate: 27/01/2023 Architecture: WINDOWS Score: 68 21 Multi AV Scanner detection for submitted file 2->21 23 Yara detected Laplas Clipper 2->23 25 Machine Learning detection for sample 2->25 6 XNeM8L3pxo.exe 1 2 2->6         started        9 ntlhost.exe 2->9         started        12 ntlhost.exe 2->12         started        process3 dnsIp4 17 C:\Users\user\AppData\Roaming\...\ntlhost.exe, PE32 6->17 dropped 14 ntlhost.exe 6->14         started        19 185.223.93.223, 49707, 49708, 49709 HOSTING-SOLUTIONSUS Netherlands 9->19 file5 process6 signatures7 27 Detected unpacking (creates a PE file in dynamic memory) 14->27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262/
Threat name:
Win32.Trojan.Strab
Create hunting rule
Status:
Malicious
First seen:
2023-01-26 09:50:31 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5riaappigju3qlmgykrojzconx3xzq5kpu5zm4jewrgli4tzyjra._file
Verdict:
malicious
Similar samples:
20ac0c20a2ef71864092cdbcdb32bb637cf76abd2ebfc5b351a6c188b9dfd05d
LaplasClipper
2a8e2ab611c7ea1a7c4e7b6fd50cef0a812ae4921a66d25106a039c90582ce29
LaplasClipper
58b415a4211b4ab0714cb45cfc92cc793c3f6ad8b1413c5f8320cfc77b5d2868
LaplasClipper
712c853955c56e27e3e4538978fa89018cdc5e5f56944ea0da2fc1a672adc73c
LaplasClipper
a53f2bbe349eb40e02353375416cb15b0723606a9909b33f7930af9c82175fbf
LaplasClipper
b62f5066357d2dfc94dec4d902f68f6e9e98a19a9aea6fb70d2811de384fd7a1
LaplasClipper
dc401554533938f33c0c6cf36246e4fc21dc687d2d3f2925bfa9f7d62a2c5fbe
LaplasClipper
+ 81 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/230127-vf9ybacb97/
Behaviour
GoLang User-Agent
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262
MD5 hash:
db79ec986805ed620baaeed1e3329b65
SHA1 hash:
0958615603ec5a321e203ce583a4f6449265d0fb
Link:
https://www.unpac.me/results/a3a65a18-409f-4392-876f-c2440e4be4bb/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ec50003de832/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.57
Link:
https://yomi.yoroi.company/submissions/ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:identity_golang
Create hunting rule
Author:Eric Yocam
Description:find Golang malware
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaplasClipper

Executable exe ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2517718/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/357552/

Comments