General

  • Target

    f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57_JC.exe

  • Size

    10.0MB

  • Sample

    230905-ykvwqsah71

  • MD5

    197bebce417f5ba6c178ee34037fbdea

  • SHA1

    d9dc871f8e61e590115bae9b0d842fae0f8f52b9

  • SHA256

    f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57

  • SHA512

    8cf7bde02dc86518d60f3836e86d3def9b9fcaf4242eaefccc6eaf2ffe61e7eaebc5d2ca114fc11169854726cce125e7f71cdb92214c1e248b4006afa2b223ad

  • SSDEEP

    49152:4EjwvlIKv05z+UERnIcYmWjc3Cdhu5E9UFiqeb0/B1Y4kIZxdez6LK+/BV6Cbfoq:OlhWzZ6hnEciqem

Malware Config

Extracted

Family

laplas

C2

http://lpls.tuktuk.ug

Attributes
  • api_key

    a0f588021b58e0c7908a163f8750678efedf2a66bf739a12427b379aef47ccde

Targets

    • Target

      f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57_JC.exe

    • Size

      10.0MB

    • MD5

      197bebce417f5ba6c178ee34037fbdea

    • SHA1

      d9dc871f8e61e590115bae9b0d842fae0f8f52b9

    • SHA256

      f927d512c8ea36edb283f9e8d5e02ab4ea25b4b143ea605284a3506cd00b8b57

    • SHA512

      8cf7bde02dc86518d60f3836e86d3def9b9fcaf4242eaefccc6eaf2ffe61e7eaebc5d2ca114fc11169854726cce125e7f71cdb92214c1e248b4006afa2b223ad

    • SSDEEP

      49152:4EjwvlIKv05z+UERnIcYmWjc3Cdhu5E9UFiqeb0/B1Y4kIZxdez6LK+/BV6Cbfoq:OlhWzZ6hnEciqem

    • Laplas Clipper

      Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks