Extracted

• • Target

    4416ae4550db7da6142def01a056aa2214036a8b718d5f17031cd9aede39fb66

  • Size

    4.5MB

  • MD5

    7e050b69e98c5ec9210f66e0c90e0b76

  • SHA1

    6fba0dbbce41e76fbc0ffb4d193e8c6e9020da18

  • SHA256

    4416ae4550db7da6142def01a056aa2214036a8b718d5f17031cd9aede39fb66

  • SHA512

    e9df367eb76b947cd38aab4c391f8fb1b94bfeafe4cf581fd51f8e1cd6da3df317e5c9aa2672fad14b121aed8a68cf570b3617007cf3f7ff9bed6d86669219a3

  • SSDEEP

    98304:5jMaFfnXAfveVnuJmhKRStK1uFbJeYUk+EPw/jh/FIYbNEWLwmVMK:5lFfXAfE4RgQUVeYUBEPw/NnNRLn6

  Score

  10^/10

  laplasclipperevasionpersistencestealertrojan

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2