General

  • Target

    setup.exe

  • Size

    1.9MB

  • Sample

    230322-bg8l4aga4z

  • MD5

    5419d85dbbb8c57fb337f1490b3d6c21

  • SHA1

    780a46377db73dc921d3a7795412b4405ea290bf

  • SHA256

    8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051

  • SHA512

    e1d84bb5105f62fe53c2be15d6c5f1c64accb17960aa1aa9cf2be7fef5a2de695bd0d11bc1c4d5f6ede8923f59847a6f5c052091ecf93a3ff3d10747b38d33ab

  • SSDEEP

    49152:d/P9nuxcamIidEoNDD1eHi8xvrRoHvVHQx2HylA5:dn9nMcaZidz/1eHBxvrqvefA5

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Targets

    • Target

      setup.exe

    • Size

      1.9MB

    • MD5

      5419d85dbbb8c57fb337f1490b3d6c21

    • SHA1

      780a46377db73dc921d3a7795412b4405ea290bf

    • SHA256

      8ee9f9bf18880afccd96ece9f1d4c384825b0de092b0ef6bd78d6d0276f67051

    • SHA512

      e1d84bb5105f62fe53c2be15d6c5f1c64accb17960aa1aa9cf2be7fef5a2de695bd0d11bc1c4d5f6ede8923f59847a6f5c052091ecf93a3ff3d10747b38d33ab

    • SSDEEP

      49152:d/P9nuxcamIidEoNDD1eHi8xvrRoHvVHQx2HylA5:dn9nMcaZidz/1eHBxvrqvefA5

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks