Extracted

• • Target

    vvvvv.exe

  • Size

    3.6MB

  • MD5

    e02b07664a5ef23facc9b0de9edfa4ad

  • SHA1

    99efbe63eea3b52751bbabde287f46d3c2d5ad13

  • SHA256

    1ff20950759aac7d67f33f56612cfdcf167478a0a4cd75d0822f4cabf3e3cebb

  • SHA512

    5ddcc0f0f154db22e10ee9344e6f65c93b723c80f3694982f1b830e6fd5ebbb82dfe31ce0372e7002df76a6474055b77a38652e5da2cc4e562c029ea3fcb44a9

  • SSDEEP

    49152:Elskpx5/18azy7dzUWhSwyAjvWetuJI0mR9+O/MjmFJtYeEm0tMpfHc/aVKu0en3:EppTaaylS05tuJYB1D7/5KCzjGo

  Score

  10^/10

  laplasclipperevasionpersistencestealertrojan

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2