{"id":5435,"date":"2023-07-20T09:28:50","date_gmt":"2023-07-20T09:28:50","guid":{"rendered":"\/cybersecurity-blog\/?p=5435"},"modified":"2024-07-24T07:50:44","modified_gmt":"2024-07-24T07:50:44","slug":"analyzing-laplasclipper-malware","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/analyzing-laplasclipper-malware\/","title":{"rendered":"Analyzing a New .NET variant of LaplasClipper: retrieving the config\u00a0"},"content":{"rendered":"\n

Recently, we’ve discovered an interesting LaplasClipper sample here at ANY.RUN<\/a>, and we’re going to analyze it in this article. Our LaplasClipper sample is written in .NET and obfuscated with Bable. <\/p>\n\n\n\n

We will dig into the sample’s configuration, study, and ultimately break through the primary obfuscation techniques the attackers employed to make the analysis process more difficult. <\/p>\n\n\n\n

What is LaplasClipper malware?<\/h2>\n\n\n\n

LaplasClipper, as its name implies, is a clipper variant. Its primary malicious function is to monitor the user’s clipboard (T1115). Attackers typically use it to swap out cryptocurrency addresses with ones they control. When users paste the address into a wallet to transfer funds, it’s the attacker’s address that receives them.   <\/p>\n\n\n\n

<\/p>\n\n\n\n

Taking the First Step of our LaplasClipper Analysis: Reconnaissance <\/h2>\n\n\n\n

For today\u2019s analysis, we\u2019re going to dissect this Laplas sample<\/a>. To understand what we’re dealing with, we\u2019re immediately going to feed it into two tools: DIE<\/strong> and ExeinfoPE<\/strong>. <\/p>\n\n\n\n

<\/p>\n\n\n\n

\"Our
Our LaplasClipper sample in Detect It Easy<\/figcaption><\/figure>\n\n\n\n

<\/p>\n\n\n\n

\"LaplasClipper
And in ExeinfoPE <\/figcaption><\/figure>\n\n\n\n

Right away, we see that it’s .NET obfuscated by Babel (T1027.002). And we also get a link to an unpacker in the form of de4dot. We’ll use this clue later. <\/p>\n\n\n\n

The Babel Obfuscator <\/strong>is one of the most popular proprietary obfuscators for .NET. It has the following set of features: <\/p>\n\n\n\n