General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqblB2dmR0ZEJaQTUzQ3ZMRGJJZW1ZSDk0Zlo4d3xBQ3Jtc0tsTG9LR0t6eS1kWHZIbGRZUU1YU1hMaEpOSHBCU0w3U0tlSnQwc1RkRGMyaWwzbWUyN2MzZF8yV0RnckpfdEdZV254X3lTd0hLdlBKdUZMQ3dDTEdXZm1lcjM3YnR3M1hiRUJYb091ZGE3aWQwQWV5WQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqsontgvucax1qbd%2FVape_V4.zip%2Ffile&v=EDL_1tp7qdA
-
Sample
221229-vkxhsagg8v
Malware Config
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqblB2dmR0ZEJaQTUzQ3ZMRGJJZW1ZSDk0Zlo4d3xBQ3Jtc0tsTG9LR0t6eS1kWHZIbGRZUU1YU1hMaEpOSHBCU0w3U0tlSnQwc1RkRGMyaWwzbWUyN2MzZF8yV0RnckpfdEdZV254X3lTd0hLdlBKdUZMQ3dDTEdXZm1lcjM3YnR3M1hiRUJYb091ZGE3aWQwQWV5WQ&q=https%3A%2F%2Fwww.mediafire.com%2Ffile%2Fqsontgvucax1qbd%2FVape_V4.zip%2Ffile&v=EDL_1tp7qdA
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Executes dropped EXE
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-