General

  • Target

    setup.exe

  • Size

    1.9MB

  • Sample

    230318-xqxf3sfe4z

  • MD5

    bdd49eb42688886ee312ae57d9d1f654

  • SHA1

    9fa1b8eb6b546d78150324b2303b9425b8f23dc5

  • SHA256

    eb9e358c4d722aff74cbcf3a4f7c11a69aad1c80e93f52f75ad94d5e4a29db02

  • SHA512

    6bb152f179c781a26107e9f3e2084f2e70fc15835c30d40cfc27d3d354ebb3214851a9cd350f1504b151fa792c5ac8d6290f3b4da5c8839ee3b759766e92a586

  • SSDEEP

    49152:fzmvpQccgreskIaAUgrqgHkrWIF994X5IBY:fzOJtqgHkVoIB

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Targets

    • Target

      setup.exe

    • Size

      1.9MB

    • MD5

      bdd49eb42688886ee312ae57d9d1f654

    • SHA1

      9fa1b8eb6b546d78150324b2303b9425b8f23dc5

    • SHA256

      eb9e358c4d722aff74cbcf3a4f7c11a69aad1c80e93f52f75ad94d5e4a29db02

    • SHA512

      6bb152f179c781a26107e9f3e2084f2e70fc15835c30d40cfc27d3d354ebb3214851a9cd350f1504b151fa792c5ac8d6290f3b4da5c8839ee3b759766e92a586

    • SSDEEP

      49152:fzmvpQccgreskIaAUgrqgHkrWIF994X5IBY:fzOJtqgHkVoIB

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks