Overview

overview

10

Static

static

7

autorun.exe

windows7-x64

10

autorun.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    30s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22-02-2023 15:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    autorun.exe

  • Size

    5.4MB

  • MD5

    610a076f83218b51b01a24e9c8eba3ae

  • SHA1

    7956cbd49823b35362f2244a350078f066873e65

  • SHA256

    fc06eb8ba18242f5a2dfb76d80ca1fe30e8df12f7c5f3d0092eb3d7fd4d51f08

  • SHA512

    bed36d4f8663e1c3e9b877367b64a2bf0ae95a86da0c02d74b29872137f370f8419359be2244e009039705f64d68eb9792dee7dd4ed1456bc54789c1ca82c707

  • SSDEEP

    98304:InGmlwPwuBvk1wu8JZfB7QJYfUbNM9VlE/V3VydE18wkcUrL5iKroh9Q4QGn7MO:InGmlgwgM18JPvCIU3V/+rLr29QUMO

Score
10/10
laplasclipperstealervmprotect

Malware Config

Extracted

Family

laplas

C2

clipper.guru

Attributes
  • api_key

    e967005093020788056c9d94da04435883edc18212f0de012679a229f024fdb6

Signatures

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect

Processes

  • C:\Users\Admin\AppData\Local\Temp\autorun.exe
    "C:\Users\Admin\AppData\Local\Temp\autorun.exe"
    1⤵
      PID:1240

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1240-54-0x0000000000B20000-0x00000000016F3000-memory.dmp

      Filesize

      11.8MB

      Download