General

  • Target

    539d9bfc0eb0a2d7b2d638926731f424e890c7b7c2a9c4410b5fe378a992e0d5

  • Size

    1.9MB

  • Sample

    230318-krqcyabg27

  • MD5

    767304da223d94dd67714d4089f354ad

  • SHA1

    cab06ce07cfd4aa406f02fb867b9dc00f6b0fbb9

  • SHA256

    539d9bfc0eb0a2d7b2d638926731f424e890c7b7c2a9c4410b5fe378a992e0d5

  • SHA512

    d1cb342c29b3c0a16c284f9453d43835efedeadcc276e83566a178fef2f67e01cb3e0ee7dbcf381b51a76f646c080b2ed63ab06f85a818fb9d11b2abc33e33b9

  • SSDEEP

    49152:DadySunZffa8wPIqp74qO+jQJvXdHOgxeZX:DKySuSPLCqHkvXdug4

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Targets

    • Target

      539d9bfc0eb0a2d7b2d638926731f424e890c7b7c2a9c4410b5fe378a992e0d5

    • Size

      1.9MB

    • MD5

      767304da223d94dd67714d4089f354ad

    • SHA1

      cab06ce07cfd4aa406f02fb867b9dc00f6b0fbb9

    • SHA256

      539d9bfc0eb0a2d7b2d638926731f424e890c7b7c2a9c4410b5fe378a992e0d5

    • SHA512

      d1cb342c29b3c0a16c284f9453d43835efedeadcc276e83566a178fef2f67e01cb3e0ee7dbcf381b51a76f646c080b2ed63ab06f85a818fb9d11b2abc33e33b9

    • SSDEEP

      49152:DadySunZffa8wPIqp74qO+jQJvXdHOgxeZX:DKySuSPLCqHkvXdug4

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks