Extracted

• • Target

    b17670d28e2cc95784b4bb1ad7a8b3eae5e69b27896f7b755f8e7550f767e116

  • Size

    4.7MB

  • MD5

    4eee6a99eb6e64650469196952f9f9fb

  • SHA1

    f526aa5b0e48790473f9da6e4dbdfe874158b149

  • SHA256

    b17670d28e2cc95784b4bb1ad7a8b3eae5e69b27896f7b755f8e7550f767e116

  • SHA512

    31c5250dbb80588121b6d01c6344e94a2f7fb06501d00af7c339a4c5694dd850779de453e8f05279c933e4d375bbf508714730bc339622ef094a2b5d9edc929d

  • SSDEEP

    98304:JPoB48l+avKBBXXO9G4/YZHEIkfhsg11omqL2b8UnuaAkLcWO2yb7Mw5R:JQZl+aC3XX54/+Heig11IBAZAkBO2O7M

  Score

  10^/10

  laplasclipperevasionpersistencestealertrojan

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2