Overview

overview

10

Static

static

3

f927d512c8...57.exe

windows7-x64

10

f927d512c8...57.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    197bebce417f5ba6c178ee34037fbdea.bin

  • Size

    6.0MB

  • Sample

    230905-bhhr3acc5v

  • MD5

    379428a897d8d80cd44318c047cdfe75

  • SHA1

    08367ee4850077cae3bc79761a197b8d282728f2

  • SHA256

    609acf6b55bfcf46693ed96ded626df50fb7db67a2f98b7d929cb530a7d1b4bc

  • SHA512

    670ee76b5e8fa32bb052ebf108d7400e9121a059d7297d71f4e8c8b2c467dda365cf603897b7f2b55e22250c2f264f44bc12e442653200f7d6947e42c75a777f

  • SSDEEP

    98304:IYDiShenKhfnaaaH2tM5eVq5105FpA0g8VFufkTZ2iLI5Kdl0BSXUQN:LDWnwnavHKQ5yFpNFn4DKL0wXUQN

Score
10/10
laplasclipperpersistencestealer

Malware Config

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Targets

    • Target

      f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57.exe

    • Size

      10.0MB

    • MD5

      197bebce417f5ba6c178ee34037fbdea

    • SHA1

      d9dc871f8e61e590115bae9b0d842fae0f8f52b9

    • SHA256

      f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57

    • SHA512

      8cf7bde02dc86518d60f3836e86d3def9b9fcaf4242eaefccc6eaf2ffe61e7eaebc5d2ca114fc11169854726cce125e7f71cdb92214c1e248b4006afa2b223ad

    • SSDEEP

      49152:4EjwvlIKv05z+UERnIcYmWjc3Cdhu5E9UFiqeb0/B1Y4kIZxdez6LK+/BV6Cbfoq:OlhWzZ6hnEciqem

    Score
    10/10
    laplasclipperpersistencestealer

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

      stealerclipperlaplas

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks