ba5d8ed167e2d340f55fcf79f370e9ff67e37097bbe57ad77ec7d68730c1ce65

Sharing

Copy URL Twitter E-mail

General

Target

VapeV4.zip
Size

82.4MB
Sample

240423-x6xf1sbb4t
MD5

e858066dc420ba50839e337748fe665b
SHA1

2f41d39b72e0a3cf2f0835a553a167543c5ee9ec
SHA256

ba5d8ed167e2d340f55fcf79f370e9ff67e37097bbe57ad77ec7d68730c1ce65
SHA512

589ee507d00b19eb6b11cda14c6334c6200964ea77e5cdbdf31462444c36fdf244d5dd006d926419a7af3e6963dcec4af167fe09a6679673a370aa1ec76d4422
SSDEEP

1572864:sRsrzFHLJ/jXfv7oi/lq/N2RGK7Ej74Y4NrMp+oIpVko5iaeaBDxE34Jf1Pk:sREpHLljH7/liN2RiPMs+oSXZFzk

Score

7^/10

Malware Config

Targets

- Target
  
  VapeV4.exe
- Size
  
  82.3MB
- MD5
  
  bb568a2a12775e52334ebcb384c4044b
- SHA1
  
  fd118c756194d88c398dc5150e728d1ab1aa1165
- SHA256
  
  c71282b1b2cd68322ff002532c93d2c7f1decb4292a897e5883a01769ab3fbc0
- SHA512
  
  dfe1d183084777d7540c6d794c5f3f4a931f87d72f1831c055c4a8c4bdba75a66d7039db6e2807ddb61068443023ebbe3e8bc1d379174bd044d09834b6564f7b
- SSDEEP
  
  1572864:K/WHHr9xtD/d/xxSO2nkjxVm8WPip32O0fry580ghdg+VUEik1J5E3QVbXs7:K/8L9xt/vxOn0xVmkhu680uJL7E7
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral3
- Target
  
  LICENSES.chromium.html
- Size
  
  8.4MB
- MD5
  
  e400cd908b8fb7c13985e2f5cc7a7044
- SHA1
  
  bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA256
  
  ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- SHA512
  
  e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP
  
  24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
Score

1^/10
behavioral4
- Target
  
  VapeV4.exe
- Size
  
  158.3MB
- MD5
  
  6da86f755f2572f73bab8fa9f2d844f6
- SHA1
  
  c8c298b6ed677a1eeedc32558cd928f7d54975d8
- SHA256
  
  f9d65681f250bb3314dfb563e9cb16086df75e5e7f9ca68f5a6508a6ecef8e85
- SHA512
  
  b199719743126b21eca3799e6953d8bc06dfb8a47c9e65e0758157e7980f0e2618a5c1d46241b29717cad075daf22aaf0b67d3b578ec6352031f94a3f7c48a27
- SSDEEP
  
  1572864:DS1SzoKmF9m9VRTgoIbBPktdQcm3fsFBYtIRJS9i1JBAeI/5UYsMPQt40ut6hE7Y:Dstl0pFRUu1
Score

7^/10
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral5
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral6
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  750bb5679a709b6037a68951cd7edd49
- SHA1
  
  10d3b066ab068500ed3226d0e80cc6778efd5fd9
- SHA256
  
  737d37d28b1eb03cb588672896f22fe8fec35b4cad1d2286e86394f1af0b381e
- SHA512
  
  d92b28c6f8ce199e85135f5b91bed8b6a8450698adf9bfad6fc26498654ee2a3f9dd8dc74e4235983e67b9ff8e4744f7719f71c74f8b3060421b24f591cc70ee
- SSDEEP
  
  49152:D8h7ilnY895zc09Myl6QL3n6F+hTf6yfPvJr8PNStFwLluJMWykOFf:zn1H9MDCn6OFMWyBf
Score

1^/10
behavioral7
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  fcb51da609bd12c4be7add00d785076e
- SHA1
  
  b87e5cd567308fa79f5a51409dc5fbd44c03a16c
- SHA256
  
  70b4d7a9c5a6414bae754e9195ce4116c267435d859515a6247d4970e5cfc2a0
- SHA512
  
  4c4d4040969cbf6d7bda4e23c6fa41da0cb1ddede0400bee1a2d623e604c71ac812770f41f90c99ae5e6bf5f55ffdca6bd197ca3b1251efbd892c12a7f8581ed
- SSDEEP
  
  6144:EI9l960ewE3X883ZrzMkBmi12EvUGsAD4IgHc:EClY0WM8JrzMIKODy
Score

1^/10
behavioral8
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  b8c51e8dbdeab2339ca9e33885553ff6
- SHA1
  
  026c284e7c3ddf3ee491bf3073fe4c54628746da
- SHA256
  
  a8ce28ca36e63d0cae939b9a72271bffd44d4df3bee586f884dcdde91353e3ec
- SHA512
  
  bb09cf5262c2af7ad369b06346abf66e41c428dc53109083d12fc9cfa969e5499c28afcdb57b66cd5187530319307de8284eea5a211cb5f1b040639fe3f51a9c
- SSDEEP
  
  98304:Nt5gLbmQACQYA7g4fdYlDOckpKOgeSXwu:NE/AVuDSoZ
Score

1^/10
behavioral9
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral10
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  c055a29d48eded654fc91227af64dfa7
- SHA1
  
  2e9dde9c9d1f612dd4ff85d6b9415c2571e20741
- SHA256
  
  f34b0949439787926295b2a7c0f45b0c8176c1668d881fd0f9f1f579f9c58295
- SHA512
  
  6948c4236394b885ae5a059376d6b78aec039cf6574689d7d8fd0c0ec7965c12e63df19b8d0834e764ad06e8f48cc6f298f7262f3549ea50376f116c7a209767
- SSDEEP
  
  49152:u6PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKY1:uNZFjAgpOz2VeCCAkEvkCvGZv9z
Score

1^/10
behavioral11
- Target
  
  vulkan-1.dll
- Size
  
  917KB
- MD5
  
  71700726c19de427a698771df0305fd9
- SHA1
  
  878c75ac6225c269edd26c295489b44cd99bdf31
- SHA256
  
  a8c740555266e601857a088ceb9c7c1b07a240fc496ad7f4124c6c7b8a694503
- SHA512
  
  cd26f9e050879ba60cbe6acae59d3d424901817775514a018bf23d606ebf52b8b3310bd0bb566dbe8681e4f666c850621ccc699aecede9fe5a827fa76c0e8dce
- SSDEEP
  
  24576:7V9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7UG3:vt2zNLnxA1+66Z5WoDYsHs6g3P0zAk73
Score

1^/10
behavioral12
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral13

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Loads dropped DLL

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13