General

  • Target

    612b18a70f6dab4cf630c4892bfe908e0eaa7ffc9411f3ac2bb37f25e3187ead

  • Size

    1.9MB

  • Sample

    230318-nmxg8seb7t

  • MD5

    e90f2482c026aab425f916f8c178350c

  • SHA1

    1bc4d3728e9eda9fb248d1aec58b22f9990c0a40

  • SHA256

    612b18a70f6dab4cf630c4892bfe908e0eaa7ffc9411f3ac2bb37f25e3187ead

  • SHA512

    fe91ab479db3ded438b41a638494d58901957a0ac7d6d80425d2048aff069791008ce6bf8d343bd8f54c3e2cf032413afc574a5ee76c4957551ac14fa197b900

  • SSDEEP

    49152:QcvCEnJ5rrgx7U/FFOAnh0Q7OuQJL/KAF4pJJ9peX9:Q0tJ5oxodTx2JR4pJJveX9

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Targets

    • Target

      612b18a70f6dab4cf630c4892bfe908e0eaa7ffc9411f3ac2bb37f25e3187ead

    • Size

      1.9MB

    • MD5

      e90f2482c026aab425f916f8c178350c

    • SHA1

      1bc4d3728e9eda9fb248d1aec58b22f9990c0a40

    • SHA256

      612b18a70f6dab4cf630c4892bfe908e0eaa7ffc9411f3ac2bb37f25e3187ead

    • SHA512

      fe91ab479db3ded438b41a638494d58901957a0ac7d6d80425d2048aff069791008ce6bf8d343bd8f54c3e2cf032413afc574a5ee76c4957551ac14fa197b900

    • SSDEEP

      49152:QcvCEnJ5rrgx7U/FFOAnh0Q7OuQJL/KAF4pJJ9peX9:Q0tJ5oxodTx2JR4pJJveX9

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks