Extracted

Extracted

• • Target

    Setup.exe

  • Size

    1.1MB

  • MD5

    18e79403815bcb2831d9383c9135edbf

  • SHA1

    cd49506de380658119a1fff1745a98316152f9e6

  • SHA256

    15dc5f309732a5d78c6f0ad0bb77baea4f6dbab4ce7d7bcad655c2ceb6de06fa

  • SHA512

    3a0f2fe4e5445ba0e633da5b3c7832e4af4e2de907a81b0d05cfbf348a41404a83682db86710825215bbfed96cb49ef2e594f973bf37a8abfc499039b1e8e7bb

  • SSDEEP

    6144:9hvWGad/1VqBFJlXdvaIBNJtJSeAOagS5pUGtiHjzk1In/yP3:jG/1VqBfdSedSYGszI

  Score

  10^/10

  laplasredline@kkkllsttnnnclipperinfostealerpersistencespywarestealer

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2