Extracted

• • Target

    d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14.exe

  • Size

    7.2MB

  • MD5

    79f92f15ae5abceeaf487bf041aec54d

  • SHA1

    05cd320d0a7f52a3511c05e54360d4512fd4da57

  • SHA256

    d79c7afdc8721f4f547c931ce6e0b20ac24193bdc63e4fee1e700e930199bc14

  • SHA512

    36c65db2149eb8b43356982533e79749a715174cf220ae519861117eaebd239531b4dc6a6db303d06171dd43d2d4371d6be40b7ea6a1cf590d7f919f2148431f

  • SSDEEP

    196608:TOZKfeUTUAYVz1ayJz2kzxXuzg6CF9X2G:TYKmUzaz1BJ2oxXAg6CLX

  Score

  10^/10

  laplasclipperpersistencestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2