laplas | e433512ad2b47afbc778ab161a218944b504c90f513ff320d2aa8bfc55d5cb25

General

Target
Full_VersionSetup_Use_2023_As_Pass.rar
Size 2.0MB
Sample230104-1kldeahg65
SHA256 e433512ad2b47afbc778ab161a218944b504c90f513ff320d2aa8bfc55d5cb25
MD5 a9e7fd1d332d4481367b35e1be6fa4ba
SHA1 8eab3fbc92f7067512c35d0884dd3b9e28941cf7
SHA512 50d60bfa9ae060086c8c6a85f5891a789e93641dc2abf0c055595476d4ff8235c094911f650c7e0747e60bccffa0aeb68b1483591298e677eece9b71c7d72874
SSDEEP 49152:JJKgrPBurQZ9cpZq3J/mXB6Ddsbrqik+mLRV4VFfRVV19crCYH8ajAoQSv8y:XKgeXpZqZkB6DdsbrdmLn43fe2g8ajPZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

laplas vidar 15 evasion spyware stealer themida trojan

Malware Config

Extracted

Family

vidar

Version

1.8

Botnet

15

C2

https://t.me/year2023start
https://steamcommunity.com/profiles/76561199467421923

Attributes

profile_id
15

Extracted

Family

laplas

C2

clipper.guru

Attributes

api_key
dd611369e3344bc4aad751531e739d725fb32f33363f67a0bf7a4ea33213af63

Targets

- Target
  Setup.exe
- Size 457.0MB
- SHA256 6afd1ceacb145d84e706c553247459bbd492733e50f21de8a42424ba7de87c62
- MD5 82121649ff44e92e9b029fcdf0e25cce
- SHA1 4b69c4e931e15655d050e8683663982fd1195f9d
- SHA512 7c0c78ceda34e6be862fbd3bf912b3f3464c63d7e55a33dcf73d4dc9ff7b788598c3d076b4ce3370d42e56c567c73bd7c0854bdefacd73cdfa3973742015628a
- SSDEEP 24576:h7/KGExULMntaZj2MQLnZPxiSJMuf/mi/pi/+5e+/LI:h7uw0AfBaxCA8
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

vidar 15 stealer laplas evasion spyware themida trojan
- Laplas Clipper
  Laplas is a crypto wallet stealer with two variants written in Golang and C#.
  stealer laplas
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  langs/Hungarian.ini
- Size 107KB
- SHA256 fe9997629d296908247a2e82da6c369e2ea7eb4c87b12fc7c8d3ecb3e6fc320d
- MD5 7591df7fae4342cbc7a0706e1b28e87b
- SHA1 825e88ad498e8713522f5aef3b21ee01d6fa8b41
- SHA512 8f58c6fbaf5ea140a3ecbbc88cbf4bdd0e0ba3fbdf169f4b7cb831094a47a6ead103f89fc07748f91d1396ebd13c7ebcc90a316f0eb203ff4c86a50be5cd3ca4
- SSDEEP 3072:UaKBsDgGod8NAH4iyf8kXrLfKgL6YhL+L3yGU:73X
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4