Extracted

• • Target

    e0ada21b18fa349d03051e23445cfd374aa5c8152bbe42a4be0efcf46964fa3d

  • Size

    3.4MB

  • MD5

    1354442cb3869536df395a944a7720b7

  • SHA1

    66fd1b7bc450f4d28d7ec64d0a59840882b72acf

  • SHA256

    e0ada21b18fa349d03051e23445cfd374aa5c8152bbe42a4be0efcf46964fa3d

  • SHA512

    b374e615853fe77521928a9c00c4505cc00060bd787da3ab5c6ca0cda6ad36e376904bf381e63a15f8dbebeb844539cb2de2e7fca78090e2d5f2dfc04fd2b9f8

  • SSDEEP

    98304:qzmz4MR7JnLQteS8kldPF/M6NhclSRhGMMOz45DE9ZSq:imJ9JLQIkldPF/pNhUSRIBOyE9Zl

  Score

  10^/10

  laplasclipperevasionpersistencestealertrojan

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2