Overview

overview

10

Static

static

1

11c3e7a62b...JC.exe

windows7-x64

10

11c3e7a62b...JC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4cexe_JC.exe

  • Size

    4.0MB

  • Sample

    230802-vakfgagh8t

  • MD5

    3258deefff3ca70f3dfa3e67067ca611

  • SHA1

    a28ec103c22b03f381dd72073cf620b11881b7b7

  • SHA256

    11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c

  • SHA512

    541eec13adbb3afcc6ee0cfea2d1ddd71036a0da9be5fe6919a2becca5dc23089754d2e5bfd15886cd8e3981f982e40d28bb467132cfdf04844d930ca612b3b8

  • SSDEEP

    98304:kIk6g0kDf8CFjiD+THrrTfmqWAfheTYC521KuM96+/xnVA:3K0skC1k+THrrTf/c5ekwgVA

Score
10/10
laplasclipperpersistencestealer

Malware Config

Extracted

Family

laplas

C2

http://206.189.229.43

Attributes
  • api_key

    f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Targets

    • Target

      11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4cexe_JC.exe

    • Size

      4.0MB

    • MD5

      3258deefff3ca70f3dfa3e67067ca611

    • SHA1

      a28ec103c22b03f381dd72073cf620b11881b7b7

    • SHA256

      11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c

    • SHA512

      541eec13adbb3afcc6ee0cfea2d1ddd71036a0da9be5fe6919a2becca5dc23089754d2e5bfd15886cd8e3981f982e40d28bb467132cfdf04844d930ca612b3b8

    • SSDEEP

      98304:kIk6g0kDf8CFjiD+THrrTfmqWAfheTYC521KuM96+/xnVA:3K0skC1k+THrrTf/c5ekwgVA

    Score
    10/10
    laplasclipperpersistencestealer

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

      stealerclipperlaplas

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks