Extracted

• • Target

    vadwax.exe

  • Size

    1205.9MB

  • MD5

    2bdd63a7fd97796129b56bd964c8af83

  • SHA1

    5ea8f5f06cb702b4e8d205cc08b860ffd2239c87

  • SHA256

    f91d9de259052595946250a1440a2457dbda9ee8aec8add24419ff939f13e003

  • SHA512

    f0383898783a2194e5a91de0d923a924787c40aa29f0095ef20bdef9e80ad515b7493edd1f5335b8c52e9b68469165103f92d6095a97a2e36a16f4b310582a7f

  • SSDEEP

    196608:HW36QOxQ8JEgOpcqGs4anqH4mJsMQOgKmEiTBh:S63Q8JExpIGnqYxMNmEiTf

  Score

  10^/10

  laplasclipperpersistencestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2