Extracted

• • Target

    c90442c160b897ea1e79e1aaca50296c.exe

  • Size

    10.9MB

  • MD5

    c90442c160b897ea1e79e1aaca50296c

  • SHA1

    88589ab90bc29923cb42e36cda6d534702ed1f57

  • SHA256

    c5c70d32d8ad4b655b43c14548aebd22c1c500ed0639dbb85580d1a8013329e4

  • SHA512

    c6bee6fae6b7534258c853ddfec03217e83e11bf11e7bb1af9ffbd3e734944a9f3d142f47962b32a81455ce5e97e3e2949ea2786efd72161ddc693a5115b692c

  • SSDEEP

    196608:5HatuBgIpTVbThhJLvzwKVKgvFXv1bbPCQHHB:5/gEVTpZVKSFvoQHHB

  Score

  10^/10

  laplasclipperpersistencestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2