General

  • Target

    197bebce417f5ba6c178ee34037fbdea.bin

  • Size

    6.0MB

  • Sample

    230905-bhhr3acc5v

  • MD5

    379428a897d8d80cd44318c047cdfe75

  • SHA1

    08367ee4850077cae3bc79761a197b8d282728f2

  • SHA256

    609acf6b55bfcf46693ed96ded626df50fb7db67a2f98b7d929cb530a7d1b4bc

  • SHA512

    670ee76b5e8fa32bb052ebf108d7400e9121a059d7297d71f4e8c8b2c467dda365cf603897b7f2b55e22250c2f264f44bc12e442653200f7d6947e42c75a777f

  • SSDEEP

    98304:IYDiShenKhfnaaaH2tM5eVq5105FpA0g8VFufkTZ2iLI5Kdl0BSXUQN:LDWnwnavHKQ5yFpNFn4DKL0wXUQN

Malware Config

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Targets

    • Target

      f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57.exe

    • Size

      10.0MB

    • MD5

      197bebce417f5ba6c178ee34037fbdea

    • SHA1

      d9dc871f8e61e590115bae9b0d842fae0f8f52b9

    • SHA256

      f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57

    • SHA512

      8cf7bde02dc86518d60f3836e86d3def9b9fcaf4242eaefccc6eaf2ffe61e7eaebc5d2ca114fc11169854726cce125e7f71cdb92214c1e248b4006afa2b223ad

    • SSDEEP

      49152:4EjwvlIKv05z+UERnIcYmWjc3Cdhu5E9UFiqeb0/B1Y4kIZxdez6LK+/BV6Cbfoq:OlhWzZ6hnEciqem

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks