General

  • Target

    setup.exe

  • Size

    1.9MB

  • Sample

    230322-bkhj3sea68

  • MD5

    eaa8dbc48c3f6d5a935141690bed014c

  • SHA1

    5778105a7e42446503dbfc69cbbd20bfd148f444

  • SHA256

    1863e62e713302b15c27801878cc1a085e6e0382bd4cc719e2ecb254d0a43051

  • SHA512

    267e2592dc91cd63ee64824cfc63fe1a42629eac6b35ea7fc5be2169cb8a3d7c6e74b41831f96bfbd87b54ac4d97484e74fddefb2465271ba3f442043f11a111

  • SSDEEP

    24576:dVPcOBkwVC63STHaiNdh8fB8dmwJVoYIlpQI0gneH3Lwk0zcdfKkQE/VQmwzQcGK:dv9LkxdKf25gneH3LwXYKkkXQeoP1w

Malware Config

Extracted

Family

laplas

C2

http://45.87.154.105

Attributes
  • api_key

    1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767

Targets

    • Target

      setup.exe

    • Size

      1.9MB

    • MD5

      eaa8dbc48c3f6d5a935141690bed014c

    • SHA1

      5778105a7e42446503dbfc69cbbd20bfd148f444

    • SHA256

      1863e62e713302b15c27801878cc1a085e6e0382bd4cc719e2ecb254d0a43051

    • SHA512

      267e2592dc91cd63ee64824cfc63fe1a42629eac6b35ea7fc5be2169cb8a3d7c6e74b41831f96bfbd87b54ac4d97484e74fddefb2465271ba3f442043f11a111

    • SSDEEP

      24576:dVPcOBkwVC63STHaiNdh8fB8dmwJVoYIlpQI0gneH3Lwk0zcdfKkQE/VQmwzQcGK:dv9LkxdKf25gneH3LwXYKkkXQeoP1w

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks