General

  • Target

    f3e5f6a779b9ff46c5e151ccad1e83fd7bf5e9d29e4ffcfa4775d0a77e99a213

  • Size

    1.9MB

  • Sample

    230317-25w63scd6t

  • MD5

    2bf7a5a8fa98cc72f6953c835531f651

  • SHA1

    284871c67b96e46064c1529119801e26e065efe3

  • SHA256

    f3e5f6a779b9ff46c5e151ccad1e83fd7bf5e9d29e4ffcfa4775d0a77e99a213

  • SHA512

    38880e544b3359abbec5b7da0573d1c5371d274bae90a4541a79b590c75a5c1ecd3e15b77a937c10c0942842634a3f6b4063a4c182f91526f7f33cc790994fbe

  • SSDEEP

    49152:qTtTRKS1gxrqJ+QfTMmB5NB4Va6xWhWR:qTtVFuMN+Q6xB

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Targets

    • Target

      f3e5f6a779b9ff46c5e151ccad1e83fd7bf5e9d29e4ffcfa4775d0a77e99a213

    • Size

      1.9MB

    • MD5

      2bf7a5a8fa98cc72f6953c835531f651

    • SHA1

      284871c67b96e46064c1529119801e26e065efe3

    • SHA256

      f3e5f6a779b9ff46c5e151ccad1e83fd7bf5e9d29e4ffcfa4775d0a77e99a213

    • SHA512

      38880e544b3359abbec5b7da0573d1c5371d274bae90a4541a79b590c75a5c1ecd3e15b77a937c10c0942842634a3f6b4063a4c182f91526f7f33cc790994fbe

    • SSDEEP

      49152:qTtTRKS1gxrqJ+QfTMmB5NB4Va6xWhWR:qTtVFuMN+Q6xB

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks