Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.zip

  • Size

    7.2MB

  • Sample

    230321-rzvqysbc37

  • MD5

    d9ec35fb5788246eceddf36acb62d041

  • SHA1

    5830f3a6b5964b82e5092bb4600525a50b59956d

  • SHA256

    f8918613f0ff3b2f7e97653c6c94cef0cb22275e3f9b05bf5aa44ad2bdeabfec

  • SHA512

    1730c732c79beef2968946d524750c4d6959b96da2e6fc37953d75fc27247cf92c97c042bc3ac5f0bd234a1673bacf828089775020a4dba537d666fd6dcb2c15

  • SSDEEP

    196608:anysdiMHCEKwYK86qYMMvH1mpdTs35LJ/+ronVb6M:anjdfiEvOYO5spLJJVb6M

Malware Config

Extracted

Family

laplas

C2

http://185.106.92.104

Attributes
  • api_key

    bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396

Targets

    • Target

      348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057.exe

    • Size

      7.3MB

    • MD5

      99f16ab6ab670935b5aa5c84b1b5f6bd

    • SHA1

      59f375481cdfe246d1ddcaada9941e16dcfda297

    • SHA256

      348014d89503967f134b988559b2ac694e0d3256708bbf7d8b96aa8c49fe1057

    • SHA512

      845e76e29adb6b7890a3a5c508e27b9731e9872bc791eeefb146b23e0e737280d19e4df1203b719f8e168a8c8a0d8ae1b4bf670da5d264bde1eece8663624d70

    • SSDEEP

      196608:Ltu5ODXM16mjmKSRFWuxx6ruj3nK/x9jWuy:L05ODcgR6mix1

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks