Extracted

Extracted

• • Target

    18b73625809a6771d23f9abd6e1ec1c15daa17e584c78aa41d4006b787500efc

  • Size

    205KB

  • MD5

    f0130124997d68396866b00f81b55549

  • SHA1

    14bca6873d214152ad35983381bfc617af39049d

  • SHA256

    18b73625809a6771d23f9abd6e1ec1c15daa17e584c78aa41d4006b787500efc

  • SHA512

    bf9d7392d3ccaf9202d55d611ae0b8deed4a508b9e477616fc9d65b686a817295664c26a9971cfc4be34df523eff795e5e88d3908240c34ef2ab7b5f086fa694

  • SSDEEP

    3072:PWahk1ech4fu0WB5gIZ/3WmH6GLCtJNYmvOuw7kqtfAFxphRM7EmA7A2/iPK:5e420UOmHJLiJBOxkqaFPM78ziP

  Score

  10^/10

  amadeylaplascollectionpersistencespywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Laplas Clipper

    Laplas is a crypto wallet stealer with two variants written in Golang and C#.

    stealerlaplas

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence
  behavioral1