Overview

overview

10

Static

static

1

ece100b824...76.exe

windows7-x64

5

ece100b824...76.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.zip

  • Size

    7.1MB

  • Sample

    230321-rzwy1sdc7y

  • MD5

    bcdfe74dee8dccba283ffc4397399265

  • SHA1

    9fae0231616d863cdfc88e8c747d5f80cf63f10c

  • SHA256

    cda2528e2de1dec310409dbc0aa11d0e368a524a9618a2e4c562ed36a132246c

  • SHA512

    f44c386381dea5358a76c3fca5f426c8e184802e3e10ececbf2a967e8fb6ac18ffb3e016233dbdb9c5d4c6d7fa5e77d83fb281569698f7e914ff1c00f0878aeb

  • SSDEEP

    98304:75bSzURw8NUlUzQ4EmXBwY/ZVUqjoSzLe41wJaZ9O2yS6JjZKGmvtt78M/7m1fpl:7F+Yw8NSgNxaye41wYO9M78A4xl4IF3l

Score
10/10
laplasclipperpersistencestealer

Malware Config

Extracted

Family

laplas

C2

http://185.174.137.94

Attributes
  • api_key

    b54641cc29f95948635d659de94166b4528e39706396a99bb9c54497b2ee3421

Targets

    • Target

      ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76.exe

    • Size

      7.5MB

    • MD5

      fb0deff37fe12bbc4f0c1fe21e2d15ef

    • SHA1

      180325b8b6e64638e167601c67cd9c53331ba9f6

    • SHA256

      ece100b8240f7eb032cb319a019eba1552ac19f563a291cf8422b1090ccf9b76

    • SHA512

      9fc013111994e943fd800abeb543563713eebebcd940b28973809a40d85271f0ed781dd95ca508e55788de2e2a575b1cb8734636f15b51a9d68f773b2cb4e73d

    • SSDEEP

      196608:bdj1WcTeKCVpVAKegYv6Pvz7xCVfQeYDprOtpN6x1Cd:RReKaAlRgxMfvihOwxy

    Score
    10/10
    laplasclipperpersistencestealer

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

      stealerclipperlaplas

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks