Malware

Laplas Clipper

Laplas Clipper is cryptocurrency-targeting clipper malware used to hijack digital-asset transactions by monitoring a victim’s clipboard for wallet identifiers and replacing copied addresses with attacker-controlled lookalike values. It has been observed in both .NET and Go-based variants, including samples protected with commercial packers, and is associated with financially motivated campaigns focused on cryptocurrency theft rather than broad destructive impact.

The malware inspects clipboard contents with regular-expression matching for numerous cryptocurrency wallet formats and related payment strings, then substitutes matching values to redirect transfers. Reported targeting includes major cryptocurrency ecosystems and related transaction formats. Laplas Clipper also communicates with remote infrastructure to retrieve regex patterns, register infected hosts, and obtain replacement wallet data, indicating centrally managed configuration and victim tracking.

On Windows systems, Laplas Clipper has been observed establishing persistence by copying itself into user profile application-data locations and creating scheduled tasks configured to execute at frequent intervals. Some variants also ensure single-instance execution through mutex creation. Network behavior includes host registration and periodic communication with operator-controlled services.

Laplas Clipper has been delivered as a secondary payload by other malware families, including SmokeLoader and StealC, and has appeared alongside other financially motivated malware such as SystemBC, RecordBreaker, Lumma Stealer, RedLine, Vidar, Raccoon, DanaBot, Amadey Bot, PrivateLoader, and NetSupport Manager. It has also been observed in campaigns that paired it with MortalKombat ransomware, where the same intrusion activity combined extortion and cryptocurrency theft. Documented delivery chains include phishing emails with malicious attachments and loader-based execution, and related activity has also involved scanning for exposed remote access services.

The malware is part of a broader cybercriminal ecosystem in which specialized loaders, stealers, proxy malware, and clippers are combined to maximize monetization from compromised hosts. Its primary operational purpose is crypto theft through clipboard manipulation, making it especially relevant to individual cryptocurrency users and organizations handling digital assets on Windows endpoints.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

25 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

A typical infection in this campaign begins with a phishing email and kicks off a multi-stage attack chain... The initial infection vector is a phishing email in which the attackers impersonate CoinPayments

T1566.001Spearphishing AttachmentEvidence1

A malicious ZIP file is attached with a filename resembling a transaction ID mentioned in the email body, enticing the recipient to unzip the malicious attachment and view the contents, which is a malicious BAT loader.

Execution

6 techniques

T1053Scheduled Task/JobEvidence2

Laplas Clipper also creates a Windows scheduled task by executing the schtasks command shown below

T1053.005Scheduled TaskEvidence1

cmd.exe /C schtasks /create /tn OQaXPFVvfW /tr ”C:\Users\<user>\AppData\Roaming\OQaXPFVvfW\TCOBAisZyL.exe” /st 00:00 /du 9999:59 /sc once /ri 1 /f

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK TTPs... Command-Line Interface - T1059

T1059.005Visual BasicEvidence1

Using an embedded VB script, the BAT loader script inflates the downloaded malicious ZIP in the “%TEMP%” location

T1197BITS JobsEvidence1

The BAT loader script uses the living-off-the-land binary (LoLBin) bitsadmin to download a malicious ZIP file from the attacker-controlled download server

T1574Hijack Execution FlowEvidence1

MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... T1574 ... DLL Side-Loading

Persistence

3 techniques

T1053Scheduled Task/JobEvidence2

Laplas Clipper also creates a Windows scheduled task by executing the schtasks command shown below

T1053.005Scheduled TaskEvidence1

cmd.exe /C schtasks /create /tn OQaXPFVvfW /tr ”C:\Users\<user>\AppData\Roaming\OQaXPFVvfW\TCOBAisZyL.exe” /st 00:00 /du 9999:59 /sc once /ri 1 /f

T1197BITS JobsEvidence1

The BAT loader script uses the living-off-the-land binary (LoLBin) bitsadmin to download a malicious ZIP file from the attacker-controlled download server

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence2

Laplas Clipper also creates a Windows scheduled task by executing the schtasks command shown below

T1053.005Scheduled TaskEvidence1

cmd.exe /C schtasks /create /tn OQaXPFVvfW /tr ”C:\Users\<user>\AppData\Roaming\OQaXPFVvfW\TCOBAisZyL.exe” /st 00:00 /du 9999:59 /sc once /ri 1 /f

Stealth

8 techniques

T1027Obfuscated Files or InformationEvidence2

This technique is not novel. It has been employed in various forms for several years to achieve different effects, all of which are related to evading defense mechanisms.

T1027.001Binary PaddingEvidence1

Binary padding is the process of adding extra or junk data to a portable executable (PE) file that, while not changing the behavior of the binary, changes certain characteristics that can help with either obfuscating relevant code or defeating sandboxing solutions and detections.

T1036MasqueradingEvidence2

drops a malicious executable file with double file extensions “<filename>.PDF.EXE”

T1070Indicator RemovalEvidence2

The loader script will run the dropped payload as a process in the victim’s machine, then delete the downloaded and dropped malicious files to clean up the infection markers.

T1197BITS JobsEvidence1

The BAT loader script uses the living-off-the-land binary (LoLBin) bitsadmin to download a malicious ZIP file from the attacker-controlled download server

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK® Techniques ... T1497 ... Virtualization/Sandbox Evasion

T1564Hide ArtifactsEvidence1

MITRE ATT&CK® Techniques ... T1564 ... Hidden Files and Directories

T1574Hijack Execution FlowEvidence1

MITRE ATT&CK® Techniques Tactic Technique ID Technique Name ... T1574 ... DLL Side-Loading

Discovery

6 techniques

T1046Network Service DiscoveryEvidence1

Practical queries for identifying malware infrastructure with FOFA.

T1057Process DiscoveryEvidence1

MITRE ATT&CK® Techniques ... T1057 ... Process Discovery

T1082System Information DiscoveryEvidence2

MITRE ATT&CK TTPs... System Information Discovery - T1082

T1120Peripheral Device DiscoveryEvidence1

MITRE ATT&CK TTPs... Peripheral Device Discovery - T1120

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK® Techniques ... T1497 ... Virtualization/Sandbox Evasion

T1518Software DiscoveryEvidence1

MITRE ATT&CK® Techniques ... T1518 ... Security Software Discovery

Collection

1 technique

T1115Clipboard DataEvidence2

Laplas ... provides its actors with the ability to substitute cryptocurrency wallet address copied by the victim with one controlled by actor.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence3

Communication with the attacker-controlled Clipper bot is performed using the HTTP GET method.

T1105Ingress Tool TransferEvidence4

upon launch of Erbium, another Trojan, Laplas “clipper”, was downloaded and installed on the same infected device.

T1571Non-Standard PortEvidence1

MITRE ATT&CK® Techniques ... T1571 ... Non-Standard Port

Exfiltration

1 technique

T1048.003Exfiltration Over Unencrypted Non-C2 ProtocolEvidence1

MITRE ATT&CK TTPs... Exfiltration Over Unencrypted Non-C2 Protocol - T1048.003

Other

1 technique

T1562Impair DefensesEvidence1

MITRE ATT&CK® Techniques ... T1562 ... Disable or Modify Tools

INDICATORS OF COMPROMISE

IOCs tracked for this family

202 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

189 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

9 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app17 days ago

domain●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

uri●●●●●●●●●●●●View more in app4 years ago

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

cyber security newsNews

Jul 21, 2026

Top 10 Malware’s used by Hackers Last Week to Launch Cyberattacks

A secondary payload explicitly described as dropped by StealC.

intezer blogNews

Jan 1, 2026

How Hackers Use Binary Padding to Outsmart Sandboxes

Laplas Clipper is referenced as a sample inflated via overlay padding to more than 600 MB, illustrating binary padding used to hinder analysis.

medium raghavtiresearchNews

Jul 26, 2025

Lumma Stealer - A Proliferating Threat in the Cybercrime Landscape | by BeGoodToAll | Medium

Mentioned only as one of several malware strains observed alongside Lumma.

embee researchNews

Jan 1, 2024

Practical Queries for Identifying Malware Infrastructure With FOFA

Clipper malware identified in this content through certificate values and favicon hash tied to its infrastructure.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching202

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping25

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Laplas Clipper