General

  • Target

    setup.exe

  • Size

    1.9MB

  • Sample

    230317-sdb76agg62

  • MD5

    a13a518eeb299eb35ef4dab64ca36dfc

  • SHA1

    f70ed33a0ae431538d248186c102588d0a655544

  • SHA256

    cbd52e865efdcce13184bb8594a5016cc973b2f30e880fc620c60dc0b5986e1c

  • SHA512

    34508043fa6f682396bef2b8638aa382a8eab294042b1ca02071abc9bf3518b866b89538373a2ca2b002e209b72ccd3cbe7c9e86ab4b97edd2a9a448288d877c

  • SSDEEP

    49152:+1iXbsGhvUq/AaqDQfM5jx9H2VatXYUq:+AXbfABsU5lrXYU

Malware Config

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes
  • api_key

    9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Targets

    • Target

      setup.exe

    • Size

      1.9MB

    • MD5

      a13a518eeb299eb35ef4dab64ca36dfc

    • SHA1

      f70ed33a0ae431538d248186c102588d0a655544

    • SHA256

      cbd52e865efdcce13184bb8594a5016cc973b2f30e880fc620c60dc0b5986e1c

    • SHA512

      34508043fa6f682396bef2b8638aa382a8eab294042b1ca02071abc9bf3518b866b89538373a2ca2b002e209b72ccd3cbe7c9e86ab4b97edd2a9a448288d877c

    • SSDEEP

      49152:+1iXbsGhvUq/AaqDQfM5jx9H2VatXYUq:+AXbfABsU5lrXYU

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks