General

  • Target

    setup.exe

  • Size

    1MB

  • Sample

    230322-bf4azsea46

  • MD5

    66cb9bf8324c1de0e44b0f376b60ab1c

  • SHA1

    59709e524dd2a2d589a9f548530bb5a682368a01

  • SHA256

    4cacc59732f82d1c1f2d3b1c327981b23438f7f47aa326e4298bee763226e85e

  • SHA512

    a511be876646d3956d1facad8b5371c26533aaa4e101db3cc974dcdbb2159562bd70d0fdceba12cea08ad00cd14b45d7367d98ba7e8087d19018145dfdb141a6

  • SSDEEP

    24576:GyekufYPXnljXYjIAu/pbifU4EvOAzfVz0dTMA8Ej06EvdxMnJlZXzk0PHDawz6f:G5gPl0CxObEWuIdITEj0XMnTZhLF6

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Targets

    • Target

      setup.exe

    • Size

      1MB

    • MD5

      66cb9bf8324c1de0e44b0f376b60ab1c

    • SHA1

      59709e524dd2a2d589a9f548530bb5a682368a01

    • SHA256

      4cacc59732f82d1c1f2d3b1c327981b23438f7f47aa326e4298bee763226e85e

    • SHA512

      a511be876646d3956d1facad8b5371c26533aaa4e101db3cc974dcdbb2159562bd70d0fdceba12cea08ad00cd14b45d7367d98ba7e8087d19018145dfdb141a6

    • SSDEEP

      24576:GyekufYPXnljXYjIAu/pbifU4EvOAzfVz0dTMA8Ej06EvdxMnJlZXzk0PHDawz6f:G5gPl0CxObEWuIdITEj0XMnTZhLF6

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks