privateloader | 306a6648c7872cbe5bdd661bdf931d8c93cb270091bdb9096e3203129c419ff3

Sharing

Copy URL

Twitter E-mail

General

Target

VapeV4.exe
Size

68.4MB
Sample

240501-yqscsshe48
MD5

9d3180bdd16963d6e979c9fd90495a00
SHA1

d96ad87c1d768d8e3020cba98060f87ed403765b
SHA256

306a6648c7872cbe5bdd661bdf931d8c93cb270091bdb9096e3203129c419ff3
SHA512

ae10249b9dbb8f905650bccb2c6fd820ffa04fd032e56fd66d077d7edec6e019b6f61e7317ec8d58c1c2a1e7280cade9227806219c698f54915c7480ae3e84cf
SSDEEP

1572864:y/WHHr9yXl3hXj9YZY1qAPP0fT1Ln7d2u0ycVZKDrFqcuQkU77:y/8L9yrz9P1qAHyxLnLlcVZKD2lU77

Score

10^/10

Malware Config

Targets

- Target
  
  VapeV4.exe
- Size
  
  68.4MB
- MD5
  
  9d3180bdd16963d6e979c9fd90495a00
- SHA1
  
  d96ad87c1d768d8e3020cba98060f87ed403765b
- SHA256
  
  306a6648c7872cbe5bdd661bdf931d8c93cb270091bdb9096e3203129c419ff3
- SHA512
  
  ae10249b9dbb8f905650bccb2c6fd820ffa04fd032e56fd66d077d7edec6e019b6f61e7317ec8d58c1c2a1e7280cade9227806219c698f54915c7480ae3e84cf
- SSDEEP
  
  1572864:y/WHHr9yXl3hXj9YZY1qAPP0fT1Ln7d2u0ycVZKDrFqcuQkU77:y/8L9yrz9P1qAHyxLnLlcVZKD2lU77
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral3
- Target
  
  Installer.exe
- Size
  
  158.3MB
- MD5
  
  552ef372c18e046d0f6537e87c9ec935
- SHA1
  
  9c294284c4f511b54451c3936aa6ea618940c4fc
- SHA256
  
  9fa9e3948a735d50662b667b5d4a42e4e1ff62d582aca29590521ead01d1366d
- SHA512
  
  0a10e2249a2d0478bacc43f08f6910c42e01284ee8ef04d2f4c0acfefca3ecf6fe41e0e017a9ccc4fa892ca37e22742c3ccb0462ddefebc1c436d857c04d5af8
- SSDEEP
  
  1572864:TULGtNWpvig2iH72GUrstdzcuo3tSONV9k9KDipAsKjUcX5j+BJwB/dlktdXQIAI:W12uI+
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral4
- Target
  
  LICENSES.chromium.html
- Size
  
  8.4MB
- MD5
  
  e400cd908b8fb7c13985e2f5cc7a7044
- SHA1
  
  bbafebdf5b067a7d7da130025851eaa52ec3c9d7
- SHA256
  
  ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
- SHA512
  
  e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
- SSDEEP
  
  24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA
Score

4^/10
behavioral5
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral6
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  98b4dac376d5980313bc7cddc38e5168
- SHA1
  
  940306c8f1ca9946d987be2bcb586c85b0d61999
- SHA256
  
  5795634e5f03fa1375b8a7e9655966beadbbe8681afd3c6996aa0f47959d053b
- SHA512
  
  234f9311fa92b5d250f970f59d837edd0373dffc8c5b44dc7a96a07b6e1b386264e3c84d7259fed9df1491d17113685c6039695f2edea3c931bc9a9f227c4f7f
- SSDEEP
  
  49152:a8h7ilnY895zc09Myl6QL3n6F+hTf6yfPvJr8PNStFwLluJMWykOFR:0n1H9MDCn6OFMWyBR
Score

1^/10
behavioral7
- Target
  
  libEGL.dll
- Size
  
  469KB
- MD5
  
  352e1ef0483c2492c5f0bf695e2ebfa7
- SHA1
  
  41be96d978e45cd0594538fe1c2faa11d6456b14
- SHA256
  
  436361c2668a445f23c7782539f5b7fd2a33beed438009d26d372e0b639f25fc
- SHA512
  
  03880cddf3810425171d0392c914e3f050c04275ea9b881890dff5c4a35f443765521a5c075d6b0a09a6c467f8b2e050889341d2e13c34908b74072599ba938c
- SSDEEP
  
  6144:VI9l960ewE3X883ZrzMkBmi12EvUGsADsIgHc:VClY0WM8JrzMIKOD2
Score

1^/10
behavioral8
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  6907ce4456aaf2282780b6f560cf7ef4
- SHA1
  
  ce54371fd09c7858ccea9f449cb60fd3f5ff5196
- SHA256
  
  555de6cbde1f9ace738c6e8b7edf35b96fc55045f09c175d6fec4bcfba206af3
- SHA512
  
  0d28296201da2eda73c36f813382255ad8b54757b907693564aa176e420f3a8072078cf31862679ec9a679e378721820ae1fb5b3bb2553d5c0244205199d97ab
- SSDEEP
  
  98304:ut5gLbmQACQYA7g4fdYlDOckpKOgeSXwm:uE/AVuDSox
Score

1^/10
behavioral9
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral10
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  f47f162198eb9a87c9cdb957523be637
- SHA1
  
  10634fb95a514b1729a00a03cd7dc88b95d83f9f
- SHA256
  
  3bd00334be2469806d3f286eb4599d897cf0fba9cf3f3c2b65ad2d2041561159
- SHA512
  
  816132e0071ba56a297f7bab51a6a3b58be3a0b51e2f4c425ac5a8ef2adfb650c5886ba80e5690a3c338f4863eabb72bf9194b7003db245fe268c5e6c0792c62
- SSDEEP
  
  49152:56PkZFjKeDTIEvAvlo6coVQxa8sVr0yN1J+MuXy557nDOPNt7wpr30sN+05uQKYh:5NZFjAgpOz2VeCCAkEvkCvGZD9z
Score

1^/10
behavioral11
- Target
  
  vulkan-1.dll
- Size
  
  917KB
- MD5
  
  5e162bcda79c966d63a15e49c8bf8c13
- SHA1
  
  2f2c77e120b66a34648c22fa23d525b1ead0df67
- SHA256
  
  25d6b4ef0a74f1a04476dc2944def16d4ca2b015277add2ebcfbc1c3df13793c
- SHA512
  
  10a89f1618b9aa96fd524f92b29506045cac8f00ee846e950591d59f6fb49a79268044424e2497e3c75815c140a458c9fb27e781a2fe1949f5eed408abe3326d
- SSDEEP
  
  24576:WV9nIy2kwpHHPDnCo3A1XpQ66Z5WoDYsHs6g3P0zAk7IG3:it2zNLnxA1+66Z5WoDYsHs6g3P0zAk7z
Score

1^/10
behavioral12
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral13

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13