Extracted

• • Target

    7de1d4823ee481df27c4ad35cbfee9f68616b05b3e12fa671a67f1f032988fc1

  • Size

    4.1MB

  • MD5

    4742e0688ce362617543f397bf5ed237

  • SHA1

    4ccf29df9bae0f0ab761cc52f2186ec11a172352

  • SHA256

    7de1d4823ee481df27c4ad35cbfee9f68616b05b3e12fa671a67f1f032988fc1

  • SHA512

    f22451e29ea7dd0c35fb7e5149a4ca3c4be25d4fd648643bcc9b77240568e11219309cac443533c76e2b50ea0b5a8118cb6a12df07b3af9ad190ded8ab8db3cb

  • SSDEEP

    98304:vNOGFwVfxGnThmA1txolQK+fBKV7mYbdC:vAGY8nThmlP+fYV7mYRC

  Score

  10^/10

  laplasclipperevasionpersistencestealertrojan

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2