General

  • Target

    3258deefff3ca70f3dfa3e67067ca611.exe

  • Size

    4.0MB

  • Sample

    230801-1yb2wsce7z

  • MD5

    3258deefff3ca70f3dfa3e67067ca611

  • SHA1

    a28ec103c22b03f381dd72073cf620b11881b7b7

  • SHA256

    11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c

  • SHA512

    541eec13adbb3afcc6ee0cfea2d1ddd71036a0da9be5fe6919a2becca5dc23089754d2e5bfd15886cd8e3981f982e40d28bb467132cfdf04844d930ca612b3b8

  • SSDEEP

    98304:kIk6g0kDf8CFjiD+THrrTfmqWAfheTYC521KuM96+/xnVA:3K0skC1k+THrrTf/c5ekwgVA

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Targets

    • Target

      3258deefff3ca70f3dfa3e67067ca611.exe

    • Size

      4.0MB

    • MD5

      3258deefff3ca70f3dfa3e67067ca611

    • SHA1

      a28ec103c22b03f381dd72073cf620b11881b7b7

    • SHA256

      11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c

    • SHA512

      541eec13adbb3afcc6ee0cfea2d1ddd71036a0da9be5fe6919a2becca5dc23089754d2e5bfd15886cd8e3981f982e40d28bb467132cfdf04844d930ca612b3b8

    • SSDEEP

      98304:kIk6g0kDf8CFjiD+THrrTfmqWAfheTYC521KuM96+/xnVA:3K0skC1k+THrrTf/c5ekwgVA

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks