Extracted

• • Target

    33515cdbda7555aa1f75bb2ce9c3d20d4385f026decb2db39d8bc0518e00e8ca

  • Size

    290KB

  • MD5

    0b55cbc503ab5a3920302d06a3d32b5d

  • SHA1

    5d316ed4ac8c03b38524fc01e78e7181ccccbb5b

  • SHA256

    33515cdbda7555aa1f75bb2ce9c3d20d4385f026decb2db39d8bc0518e00e8ca

  • SHA512

    84077405ce5cdad23fde89642281d5d978048f3ad568970e1bff59993ad2c022eaff2a250bfbc0a74fe8c2eea4c68f39bd7d854e4656866b9bf486308b50ae4d

  • SSDEEP

    3072:2nUnLLQo1s4UK/z8B1ed7WUI5RfqmjuO5kAJ5Rf0JhjX:9nLLQeUK/Yed85Rf/kAdfuhr

  Score

  10^/10

  laplasclipperdiscoverypersistencespywarestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1