General
-
Target
c38710996ada2b204f1959a1aa09b59a880b3c1ef4a23aebb7cb73f6eac4704a
-
Size
332KB
-
Sample
230318-nfnazseb4x
-
MD5
d0058c6d0c8d1ebce15e7901810c86c7
-
SHA1
177f50849843a30b431bbf7bff3003617cf1f7f9
-
SHA256
c38710996ada2b204f1959a1aa09b59a880b3c1ef4a23aebb7cb73f6eac4704a
-
SHA512
0947b82cb88b6c742ecc5867fff260e24f40d39eb1ee01b4d90661192788488bdfb095ed714fb7ade4ad909a4db2836da7426a6a55ab646bf51ce646391be524
-
SSDEEP
3072:cZ42JluAG1/LSFKjpM7sGL4ErllXwF02B1hqmdUL2RxoPtwO/Q:gJXG1/LuKjBGLvplE0wEG7K/Q
Static task
static1
Malware Config
Extracted
laplas
http://45.87.154.105
-
api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767
Targets
-
-
Target
c38710996ada2b204f1959a1aa09b59a880b3c1ef4a23aebb7cb73f6eac4704a
-
Size
332KB
-
MD5
d0058c6d0c8d1ebce15e7901810c86c7
-
SHA1
177f50849843a30b431bbf7bff3003617cf1f7f9
-
SHA256
c38710996ada2b204f1959a1aa09b59a880b3c1ef4a23aebb7cb73f6eac4704a
-
SHA512
0947b82cb88b6c742ecc5867fff260e24f40d39eb1ee01b4d90661192788488bdfb095ed714fb7ade4ad909a4db2836da7426a6a55ab646bf51ce646391be524
-
SSDEEP
3072:cZ42JluAG1/LSFKjpM7sGL4ErllXwF02B1hqmdUL2RxoPtwO/Q:gJXG1/LuKjBGLvplE0wEG7K/Q
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-