Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.zip

  • Size

    7.1MB

  • Sample

    230321-rzrz3abc34

  • MD5

    4ddcbea7d33bdcee725337fdd85cce4a

  • SHA1

    281aa91f44c3738ccac841dc8d3030143a952c97

  • SHA256

    bd0a3f94c283fbb440e90ce6d24b145f5f0fdbf71864e97d6e6c549ecb28f08d

  • SHA512

    be09c7169d327f24815ee6687a2583c72b07a752f191a85ec87012df20c3906ce736ddc0d11aea9645ac75cab718917edb7e67a3fb54f14521fe86110e896815

  • SSDEEP

    196608:g9Cn0aBJ0EqJJoqEZxDPvB7hlIEZ55BcFbpLZSBp+g:g9C0MJ0EOJoqMlllB5WnOp9

Malware Config

Extracted

Family

laplas

C2

http://212.113.106.172

Attributes
  • api_key

    a8f23fb9332db9a7947580ee498822bfe375b57ad7eb47370c7209509050c298

Targets

    • Target

      00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc.exe

    • Size

      7.5MB

    • MD5

      f5d957a42f578847664cacb8a4c3d695

    • SHA1

      5affbea912936570480b7a6a0a7e67c6a2f62ec9

    • SHA256

      00978d16ecc2b0f6cf039b3bef087a8542d2092d8f95f36104f2329f7bf362dc

    • SHA512

      07821df782858665c810e959e92f78de4af56e8d090069c5637537338244f9348f7a878bff95d72620b4c092fd97cfb2d15ffe1c097c36a86399a478ea406980

    • SSDEEP

      196608:ZOtzW0BrGc/4GmLcBh8YSZIEqsyZr2caC78:kVW6Gc//B/xEh+a

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks