Extracted

• • Target

    setup.exe

  • Size

    291KB

  • MD5

    8cca6d631010620a368ddc7925c0649c

  • SHA1

    cbac7cdb0b393a64a25726c09c718616e83ffa8f

  • SHA256

    15539a353d5b7e18b87b30f717454dc25c4261954d97af791596ea49acb1fa92

  • SHA512

    4c38a618668d2fe78ee950aaadd4f32d7f4ff3130039efefb1e039bc79aeedb2e065141fdd96d4255735ffb68a991b83e0d4609e02a76a958c99feda4f24135c

  • SSDEEP

    3072:2D2H6X9LmnZiTw5aX/ifwSYt3pkki/c9yEh+vp5nbrSLJhCe:MX9LmnMTlX/iYSYPkR/cWvzvohC

  Score

  10^/10

  laplasclipperdiscoverypersistencespywarestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2