MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f590c0c73d69783f270cd933658d16ba7e9902726854b8274e52e4708db7602e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


LaplasClipper


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f590c0c73d69783f270cd933658d16ba7e9902726854b8274e52e4708db7602e
SHA3-384 hash: cfe7b22c4376227ed0742a9fdfd765e2216c770487a71f5a38d7c9c56b1b55c1b6434922ca29e72b18c65f5e849ff12a
SHA1 hash: 77f932a93923e6c9fdfd9d337afd9585ac45f762
MD5 hash: 526ac92b0b4c8c65d1fcb7beea767320
humanhash: kilo-maryland-don-yankee
File name:526ac92b0b4c8c65d1fcb7beea767320.exe
Download: download sample
Signature LaplasClipper
Create hunting rule
File size:1'869'312 bytes
First seen:2023-02-06 09:45:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash aea30aa8311fa7a3ea56995ee020184d (6 x RedLineStealer, 2 x Smoke Loader, 1 x LaplasClipper)
ssdeep 24576:/LN0Z/7qRAzUqiNie75oBNsZreHmBiHAqGnPhOpx978h81z7Ryfhusl3clGnQP28:/h0ZGiiNiI6NsBGCnpsH51PASlFPXFL
Threatray 105 similar samples on MalwareBazaar
TLSH T17C8533127792D031C036D4787825D3AAF6BD683101B9E95737E4C7A91E352C26E3E3AB
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 816a6e6a6a6a6a60 (22 x RedLineStealer, 8 x Smoke Loader, 4 x Amadey)
Reporter abuse_ch
Tags:exe LaplasClipper

Intelligence

File Origin
# of uploads :
1
# of downloads :
187
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
526ac92b0b4c8c65d1fcb7beea767320.exe
Verdict:
Malicious activity
Analysis date:
2023-02-06 09:49:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0de1b4ef-7e5d-4945-ad76-442a91491d73

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/360764/
Detection(s):
SecuriteInfo.com.MSIL-51.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending an HTTP GET request to an infection source
Verdict:
No Threat
Threat level:
  2/10
Confidence:
75%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63e0cc5c89bd67c10fdcbec1/reports/58bb4661-f608-419c-8a8f-1edfa9e52731/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/f590c0c73d69783f270cd933658d16ba7e9902726854b8274e52e4708db7602e
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Titan Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fbc1c470-e674-40b6-8e22-ec4b09ce9f56
Result
Threat name:
Laplas Clipper
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1166460
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Laplas Clipper
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f590c0c73d69783f270cd933658d16ba7e9902726854b8274e52e4708db7602e/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2023-02-05 19:28:51 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
27 of 38 (71.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6wimbrz5nf4d6jym3ezwldiwxj7jsatsnbklqj2oklshbdnxmaxa._file
Verdict:
malicious
Similar samples:
1063dbd630ff2a5917a3f66fca581c5742172d2fdb8e6f7c2cfa6d68fdd90420
LaplasClipper
2897232c5333d1ba26ab1b9769b1bd87894f2c8d1f6c6c3cb0fa47d8b3afc56d
LaplasClipper
2a8e2ab611c7ea1a7c4e7b6fd50cef0a812ae4921a66d25106a039c90582ce29
LaplasClipper
4a456d44f22ba4a4e1eaa83510a1872aad10075d95f8c8fff747a28f68d466a7
LaplasClipper
707e8d1989268db912cc9c2fc95c82aac61aaee789ef40aa0ccc52ae14282d5b
LaplasClipper
70f55017e476683211c4e7caea2bb4301476decb9e2608df7f7dd10ff99adc35
LaplasClipper
712c853955c56e27e3e4538978fa89018cdc5e5f56944ea0da2fc1a672adc73c
LaplasClipper
c6bba34f8198331c883212aeb76f4ee436df04cfc8a121c12401de1a35169f2e
LaplasClipper
cbda4e6ad06b72aa1b82106c8ebec0df6ff5e5ff362f1753563f0a763440a9c5
LaplasClipper
ec50003de83269b82d86c2a2e4e44e6df77cc3aa7d3b967124b44cb47279c262
LaplasClipper
+ 95 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/230206-lrmgqadc57/
Behaviour
GoLang User-Agent
Suspicious use of WriteProcessMemory
Adds Run key to start application
Executes dropped EXE
Unpacked files
SH256 hash:
75e795f38ba7f689c73a3bb86ef959b5e48958aafbcdc36e582f1f6d7b7139ec
MD5 hash:
23aeddebf2e77375b20b18a801759aab
SHA1 hash:
e6b7560ff5f88a8bc79a66383e8c70cc34ca38a0
Link:
https://www.unpac.me/results/c15614f1-27f6-4874-beef-cbcac5ac12e4/
SH256 hash:
f590c0c73d69783f270cd933658d16ba7e9902726854b8274e52e4708db7602e
MD5 hash:
526ac92b0b4c8c65d1fcb7beea767320
SHA1 hash:
77f932a93923e6c9fdfd9d337afd9585ac45f762
Link:
https://www.unpac.me/results/c15614f1-27f6-4874-beef-cbcac5ac12e4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f590c0c73d69/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f590c0c73d69783f270cd933658d16ba7e9902726854b8274e52e4708db7602e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

LaplasClipper

Executable exe f590c0c73d69783f270cd933658d16ba7e9902726854b8274e52e4708db7602e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2526801/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/360764/

Comments