Extracted

• • Target

    203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08

  • Size

    2.6MB

  • MD5

    3f821e69fe1b38097b29ac284016858a

  • SHA1

    3995cad76f1313243e5c8abce901876638575341

  • SHA256

    203abb4fef06659cf437ca0d5c338b7e0ed1add2645361ba92ab5aab6e3a0e08

  • SHA512

    704a799fae6f6139f9c66a1f11bff243a4381ff69028b1fc1f903c8c75d303a9769b6843c67f794c1c85dd9b10dd1c07bead63702a2f077cb467e5a50c99d5d7

  • SSDEEP

    49152:/oLi8Bd2MIUueEcBY6rCYIvkQIIZB9mnJWUyzD8A04Z/f8I:ALi8B0MiCBbC3IIZB9cKzomZ/kI

  Score

  10^/10

  laplasclipperevasionpersistencestealertrojan

  • Laplas Clipper

    Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.

    stealerclipperlaplas

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2