Extracted

• • Target

    dd9b8dbe2a4bd2f65eab24664fe843325690731cfeff8efa5aeaf24e6565fe69.exe

  • Size

    263KB

  • MD5

    a5738bf405e2d273310bb9eea4275555

  • SHA1

    d582cad53d78f41f4d2ea814e083e5291e59820b

  • SHA256

    dd9b8dbe2a4bd2f65eab24664fe843325690731cfeff8efa5aeaf24e6565fe69

  • SHA512

    bb15f79ce0b5be6d1ff0be8740f5bc6acd65b260c1e41b3645f53685ced7fc29aa450173a599f42ee88ae9ecd5213fa22d65378c90269ccb1973ad1076235f45

  • SSDEEP

    3072:4A9FDcQxP9TF9CeVQtVVO/gCyVed1XCCyj3yvKJIvVEhSZ1hvJzmCpZmcgl11ycW:lFgQxP9T6y6V7U453yyIthZnlZQzu

  Score

  10^/10

  laplasclipperpersistencestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2