laplas | jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df

General

Target
jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df
Size 4.8MB
Sample261016-jjp7jat19l
SHA256 a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df
MD5 370d634ba42930998329a6f08432e9e8
SHA1 40c9579d9d6150bce086d00a3ecc0751779b9dca
SHA512 23475d2b7bf6279a5adfc0802f057636d0825d71a9b394a5fefa6e09e69535e23585f80eb1084a782a612fe45733fae583168b0bea8a693b515f5d63d19a197e
SSDEEP 49152:SAMKyiGxtRJHH5VFmJgBaShRgpCMYh4fFvL9Xq+mbtXTC60HjGS5g+A:dMQGxtxVFmJgXxl4dv0b1+I+A
TLSH
T1A0364B17FCA214F9D5BEF13086529322BAB178A943303BD35F9496691A26FD0BB3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer clipper laplas

Malware Config

Extracted

Family

laplas

C2

clipper.guru

Attributes

api_key
be8b883b0f281dda9a96404db70e3988b9c0bec8ec0ad6fca6a9f03ba18c595a

Signatures

Family: Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df

File Explorer

jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df

.exe 4.8MB

jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df

IMPHASH 93a138801d9601e4c36e6274c8b9d111
SHA256 a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df
MD5 370d634ba42930998329a6f08432e9e8
SHA1 40c9579d9d6150bce086d00a3ecc0751779b9dca
SHA512 23475d2b7bf6279a5adfc0802f057636d0825d71a9b394a5fefa6e09e69535e23585f80eb1084a782a612fe45733fae583168b0bea8a693b515f5d63d19a197e
SSDEEP 49152:SAMKyiGxtRJHH5VFmJgBaShRgpCMYh4fFvL9Xq+mbtXTC60HjGS5g+A:dMQGxtxVFmJgXxl4dv0b1+I+A
TLSH
T1A0364B17FCA214F9D5BEF13086529322BAB178A943303BD35F9496691A26FD0BB3D311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

441728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

257KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df

kernel32

generic

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

jaffacakes118_a96bf5c25a9db9b098215aa633a7cd8d3e0b8378e60f47813c05a5c342da98df

kernel32

generic