Malware

LaplasClipper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

It has also been delivered via spear-phishing campaigns.

Execution

2 techniques

T1106Native APIEvidence1

During runtime, it dynamically loads more libraries and imports using GetProcAddress + LoadLibrary.

T1129Shared ModulesEvidence1

During runtime, it dynamically loads more libraries and imports using GetProcAddress + LoadLibrary.

Persistence

2 techniques

T1543Create or Modify System ProcessEvidence1

It loads the file to inject into memory, opens the file written in the path ... and opens it in a suspended state to write to it. It then releases it using ResumeThread.

T1547.001Registry Run Keys / Startup FolderEvidence1

We can observe the execution of a binary that establishes persistence in \CurrentVersion\RUN.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

Subsequently... it proceeds with injection... opens it in a suspended state to write to it. It then releases it using ResumeThread.

T1543Create or Modify System ProcessEvidence1

It loads the file to inject into memory, opens the file written in the path ... and opens it in a suspended state to write to it. It then releases it using ResumeThread.

T1547.001Registry Run Keys / Startup FolderEvidence1

We can observe the execution of a binary that establishes persistence in \CurrentVersion\RUN.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Depending on the version, I encountered samples packed with MPRESS or ones with obfuscated sections that were gradually deobfuscated during runtime.

T1055Process InjectionEvidence1

Subsequently... it proceeds with injection... opens it in a suspended state to write to it. It then releases it using ResumeThread.

T1140Deobfuscate/Decode Files or InformationEvidence1

Depending on the version, I encountered samples packed with MPRESS or ones with obfuscated sections that were gradually deobfuscated during runtime.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

it somehow retrieves system information... it collects elements such as the OS version, computer and user names, time, and device language.

Collection

1 technique

T1115Clipboard DataEvidence1

The malware constantly monitors the clipboard... it waits for one of those patterns to be written to the clipboard. When this happens, it changes the wallet address to one controlled by the attacker.

Command and Control

1 technique

T1095Non-Application Layer ProtocolEvidence1

After this, we’ll observe the malware delving into network functions... it makes a request to an address commonly used by LaplasClipper: Clipper[.]guru. Following this, it sends data to the attacker, including information about our machine and a generated identifier.

INDICATORS OF COMPROMISE

IOCs tracked for this family

16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

rexorvc0 blogNews

Sep 4, 2023

LaplasClipper | RexorVc0

Cryptocurrency clipboard hijacker that establishes persistence, gathers basic victim system information, injects into a dropped process, monitors the clipboard for wallet-related patterns, and replaces copied wallet addresses with attacker-controlled ones to steal cryptocurrency.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching16

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

LaplasClipper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

It has also been delivered via spear-phishing campaigns.

Execution

2 techniques

T1106Native APIEvidence1

During runtime, it dynamically loads more libraries and imports using GetProcAddress + LoadLibrary.

T1129Shared ModulesEvidence1

During runtime, it dynamically loads more libraries and imports using GetProcAddress + LoadLibrary.

Persistence

2 techniques

T1543Create or Modify System ProcessEvidence1

It loads the file to inject into memory, opens the file written in the path ... and opens it in a suspended state to write to it. It then releases it using ResumeThread.

T1547.001Registry Run Keys / Startup FolderEvidence1

We can observe the execution of a binary that establishes persistence in \CurrentVersion\RUN.

Privilege Escalation

3 techniques

T1055Process InjectionEvidence1

Subsequently... it proceeds with injection... opens it in a suspended state to write to it. It then releases it using ResumeThread.

T1543Create or Modify System ProcessEvidence1

It loads the file to inject into memory, opens the file written in the path ... and opens it in a suspended state to write to it. It then releases it using ResumeThread.

T1547.001Registry Run Keys / Startup FolderEvidence1

We can observe the execution of a binary that establishes persistence in \CurrentVersion\RUN.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Depending on the version, I encountered samples packed with MPRESS or ones with obfuscated sections that were gradually deobfuscated during runtime.

T1055Process InjectionEvidence1

Subsequently... it proceeds with injection... opens it in a suspended state to write to it. It then releases it using ResumeThread.

T1140Deobfuscate/Decode Files or InformationEvidence1

Depending on the version, I encountered samples packed with MPRESS or ones with obfuscated sections that were gradually deobfuscated during runtime.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

it somehow retrieves system information... it collects elements such as the OS version, computer and user names, time, and device language.

Collection

1 technique

T1115Clipboard DataEvidence1

The malware constantly monitors the clipboard... it waits for one of those patterns to be written to the clipboard. When this happens, it changes the wallet address to one controlled by the attacker.

Command and Control

1 technique

T1095Non-Application Layer ProtocolEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 years ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

rexorvc0 blogNews

Sep 4, 2023

LaplasClipper | RexorVc0

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching16

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.