Overview

overview

10

Static

static

1

recoverit_...up.exe

windows7-x64

10

recoverit_...up.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    recoverit_pr_setup.exe

  • Size

    491KB

  • Sample

    230206-tfvyqaaa2z

  • MD5

    af10d0f3f2fa79ba3051c2a96262b065

  • SHA1

    88cf689dc6220a368dc5daaede70ea1fc5ffdb09

  • SHA256

    320bf1b89342b15959fb29c944089d8d6e3c23108cdced1c912b0ea639000ba7

  • SHA512

    4feb7c9f2d25486f5848dcd62e03030af99f0b077d91696a567bb60eed73f87a357896af616c778bf4f12d053b2108c861d54c43b1a8ba1a4ad1784030f8fdab

  • SSDEEP

    6144:eoOL6qi0cPHdUgJVwqbPQkHp8jdbAIcTA3S7j6gk5oTIs5TeUQr:eF2qi9WgJtPfHqRb9mYSn61+ISTfQr

Score
10/10
laplasrhadamanthysclippercollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

laplas

C2

45.159.189.105

Attributes
  • api_key

    b208717c54146010ab89e628591e2a7b11493ef1c593e7b3f15b1c06b1778d59

Targets

    • Target

      recoverit_pr_setup.exe

    • Size

      491KB

    • MD5

      af10d0f3f2fa79ba3051c2a96262b065

    • SHA1

      88cf689dc6220a368dc5daaede70ea1fc5ffdb09

    • SHA256

      320bf1b89342b15959fb29c944089d8d6e3c23108cdced1c912b0ea639000ba7

    • SHA512

      4feb7c9f2d25486f5848dcd62e03030af99f0b077d91696a567bb60eed73f87a357896af616c778bf4f12d053b2108c861d54c43b1a8ba1a4ad1784030f8fdab

    • SSDEEP

      6144:eoOL6qi0cPHdUgJVwqbPQkHp8jdbAIcTA3S7j6gk5oTIs5TeUQr:eF2qi9WgJtPfHqRb9mYSn61+ISTfQr

    Score
    10/10
    laplasclippercollectiondiscoveryspywarestealerrhadamanthys

    • Detect rhadamanthys stealer shellcode

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

      stealerclipperlaplas

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks