Extracted

• • Target

    48f6242537331f5142237c388fc8fa1f52eecd568af2af01695342b1d17c4fd4

  • Size

    3.8MB

  • MD5

    12d16c90620269cc665ce370dbe15784

  • SHA1

    72fa84e606ee749844143e5904c14975e2d5d98c

  • SHA256

    48f6242537331f5142237c388fc8fa1f52eecd568af2af01695342b1d17c4fd4

  • SHA512

    aa0d992d1c9353a79d3d7984b1031b950b4022850c164ef6453f65de680f8d8d7b5d389feae2f494cde8403b7af000a3a90b78b19de36f23594db31b2ab74b67

  • SSDEEP

    98304:aLa6vbZldIleZXkleKgxYC+ywWj5fr1018mHXM:aLa6vbZlmleZX7KAYCuWjhr12u

  Score

  10^/10

  laplasevasionstealerthemidatrojan

  • Laplas Clipper

    Laplas is a crypto wallet stealer with two variants written in Golang and C#.

    stealerlaplas

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2