laplas | 833b7887085a8c45b708a34478d96edbd3efa5838339194303001ff3c563fe9a | Triage

Sharing

General

Target

2297b0cced9fde691e8f430d0198f76227b3e617658a6119753d942f9677f589.zip
Size

1.7MB
Sample

230321-rzsatsdc7w
MD5

65d977de852b3b26e586127e1d24831e
SHA1

89579263fe5f411ec09f7c3b1cb5aaf8e205bbb4
SHA256

833b7887085a8c45b708a34478d96edbd3efa5838339194303001ff3c563fe9a
SHA512

ca3c832e87bf034a390e1abcb1fc87b40540d3a085ebef2cdb1f74978f2fc2236777e5c94781f1d55fc812e2c014d2ba1734c70db8a8bdfc2224a3b869500b97
SSDEEP

49152:bU6u4lHPU1zudJPVYtuNaPdSqI1BUq8clYKdI:bU6u4dU9OBVdNaPdSkVKdI

Score

10^/10

laplas clipper persistence stealer

Malware Config

Extracted

Family

laplas

C2

http://45.159.189.105

Attributes

api_key
9ee0ef01cd0f0468c997745b63f39799e510412a4bb4e6ff8efcf6f8ac926172

Targets

- Target
  
  2297b0cced9fde691e8f430d0198f76227b3e617658a6119753d942f9677f589.exe
- Size
  
  1.9MB
- MD5
  
  8c59b0c004d6d108c494ed8e96f573bb
- SHA1
  
  62856aa334190053f0e3b41f7f379a77aaf1cdb1
- SHA256
  
  2297b0cced9fde691e8f430d0198f76227b3e617658a6119753d942f9677f589
- SHA512
  
  2c966dde8aa92dec51080a02a38c8ed207cd51fc8196bd6a92e3eff316bb6370c90900f3b6c0d5d06e93f34ef925c509cb2c11f3d16a0cd3dc8984f853f85a6d
- SSDEEP
  
  49152:mG1dhlVkEIUaOM8Tb9E4V4GwayVg53tW0S6ndKE:mG/hkPUaX8/64x0g5jS24
Score

10^/10

laplas clipper persistence stealer
- Laplas Clipper
  Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
  stealer clipper laplas
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

laplasclipperpersistencestealer

behavioral2

laplasclipperpersistencestealer