Extracted

• • Target

    bc169d66a15f7a459d73225fe925d3d08fa693530313bc6f31b2e711eaad1f0e

  • Size

    291KB

  • MD5

    c0cddc95c61243fcc138abdedd77036d

  • SHA1

    bc7a72334c9d38bd12ca62812720f3eb62a8e6de

  • SHA256

    bc169d66a15f7a459d73225fe925d3d08fa693530313bc6f31b2e711eaad1f0e

  • SHA512

    c9f2bddac82468a9aae8dcb5c577de1901b28d02adb4f9ee27d7ca18f1168111d0c56c143b467af987ed33020780dc7c5a18ff4e2a41d7ac78855e9bad98d7db

  • SSDEEP

    3072:tD0WX/L6PD0HApNr0mjugOIBwZgVZ5i5Ib7pJhD5:/X/L6LWENrTggdrfjhD

  Score

  10^/10

  laplasclipperdiscoverypersistencespywarestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1