Extracted

• • Target

    348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe

  • Size

    7.3MB

  • MD5

    99f16ab6ab670935b5aa5c84b1b5f6bd

  • SHA1

    59f375481cdfe246d1ddcaada9941e16dcfda297

  • SHA256

    348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057

  • SHA512

    845e76e29adb6b7890a3a5c508e27b9731e9872bc791eeefb146b23e0e737280d19e4df1203b719f8e168a8c8a0d8ae1b4bf670da5d264bde1eece8663624d70

  • SSDEEP

    196608:Ltu5ODXM16mjmKSRFWuxx6ruj3nK/x9jWuy:L05ODcgR6mix1

  Score

  10^/10

  laplasclipperpersistencestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2