Extracted

Extracted

• • Target

    Setup.exe

  • Size

    1024.0MB

  • MD5

    5e379c09784c0b093d430f5438ea881d

  • SHA1

    b73aecf39e5909bc972ca3eabc147c30dbde4caf

  • SHA256

    bfe4a7fd2312bac3c06a31985a1884be39af15aa310c5396bbb4d51a23324499

  • SHA512

    ac28d28e5ec9a5a5b0ff5621fa4213bf4c54ab3937d2efc0abf1ffd71f18ae7ef31b0e15e75168d3f7ba4e3f9aaae2bc868996b5c83e11efe42427a0a648be60

  • SSDEEP

    98304:h77a3TZRRiRRRwRRRRRRR6RURRFRRRRdRRRRRRJRRRRRRRRRRRRRRER7RRRRRRRS:h77BmnfzuL21F5oQegx+U

  Score

  10^/10

  laplasvidar41259ba39e7d2a1b343e34c89786c56fclipperevasionpersistencespywarestealerthemidatrojan

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Stops running service(s)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Uses the VBS compiler for execution

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2