Extracted

• • Target

    7ab2228581a86441739dfb6f4e8057cd220abdabe13fa2f2a8d9ee904e5612f6.exe

  • Size

    297KB

  • MD5

    c1378f7991f51df8a693533c12d87b77

  • SHA1

    a158c289e1f6016dbb9f31924e7bf3879f09653f

  • SHA256

    7ab2228581a86441739dfb6f4e8057cd220abdabe13fa2f2a8d9ee904e5612f6

  • SHA512

    7537668e6851d415dbf2635aee2daff4348664ee16bb58e2d14f8fcb6b8f314ec1a65c7286341012727a1902e1f31b71c6a9dd00c9cd4be6b03d248f9deb68d7

  • SSDEEP

    3072:0n7mRSVeIn8O9iyGvSzQb6SEZ5Q3tmsvL88dXa23CcxsD4zpS9uSRh5qHeNNrAjp:AQkTiyGvSzhsvL8K3Cv4g9vh0Gof

  Score

  10^/10

  laplasclipperpersistencestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2