General
-
Target
VapeLite.exe
-
Size
60KB
-
Sample
230419-bwqd3ahc4x
-
MD5
2c18f9f475cf661c784f95b8c43f0fe1
-
SHA1
b8b125aa65b9c5f7a7015415e21a4c4b263c8388
-
SHA256
7ae958d30d0e97289b4b23fa487450cd45f8f9f72b6f9507c423fabce204dbb3
-
SHA512
dc9d8e897dde91f54e3104219a99f3d41e7459fb538fc3cf15c0ad9774ca700763b6b47495fb711ff4763bbe7e261d3019c850ac636df272ba0e61036b163f05
-
SSDEEP
768:bOucKn7n1JVDNANIUKRvLDwUzc80gmq3oP/oDn:bO2VDNAPcr/0O8/oz
Static task
static1
Behavioral task
behavioral1
Sample
VapeLite.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
VapeLite.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
VapeLite.exe
-
Size
60KB
-
MD5
2c18f9f475cf661c784f95b8c43f0fe1
-
SHA1
b8b125aa65b9c5f7a7015415e21a4c4b263c8388
-
SHA256
7ae958d30d0e97289b4b23fa487450cd45f8f9f72b6f9507c423fabce204dbb3
-
SHA512
dc9d8e897dde91f54e3104219a99f3d41e7459fb538fc3cf15c0ad9774ca700763b6b47495fb711ff4763bbe7e261d3019c850ac636df272ba0e61036b163f05
-
SSDEEP
768:bOucKn7n1JVDNANIUKRvLDwUzc80gmq3oP/oDn:bO2VDNAPcr/0O8/oz
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Sets desktop wallpaper using registry
-