Extracted

• • Target

    Vape.exe

  • Size

    7.3MB

  • MD5

    30d821e3f24b92090b1bce6724c9128d

  • SHA1

    f0d9125615d765fe195344699d025e275992dd51

  • SHA256

    62395ab41ce937d63d729857316897a8b492248c2a47417500a66189400e223b

  • SHA512

    199d4bf7811d6627213f4196b195c6b7845abb8aae28c22d75099835030a8d6c3ec3a53014ee17853dd3c9c367c8d3ee9551127553655bd81dc144c0b98ca104

  • SSDEEP

    196608:yJY/4gmohCSiu0y17vTSnBlXpOR7uRBp0/T:yJY/1mohKu0ypvunBlXYyt0r

  Score

  10^/10

  xwormpersistencerattrojanupx

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1