General

  • Target

    VapeV4-crack-loader-main.zip

  • Size

    9.2MB

  • MD5

    ea57731fb8c3ffabdeae90c26d4b0fcc

  • SHA1

    d63650592a3864aa36a33028444e8422b213f50b

  • SHA256

    7928b1e29853be208f9cd41ce51181c80c2654789d509142f784cdb391886e63

  • SHA512

    e97a56aaf1221f327bfb63751ebe2afe2f1a60281d230b501209ee80a3485b1fffe1fe47bc20ad94ad758f911e1c00f06ce8adeea5cbcf2883940919fd00d258

  • SSDEEP

    196608:b0RdM6c50RdM6chixuvQ3eGDRHAnJXUf8DVgv8FfaNweCMS0RdM6cA:b0b650b6HcenJEUDqv8Fi2eCJ0b6A

Malware Config

Extracted

Family

xworm

C2

into-hybrid.gl.at.ply.gg:56462

Attributes
  • Install_directory

    %AppData%

  • install_file

    Defender.exe

Signatures

  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • AgentTesla payload 3 IoCs
  • Agenttesla family
  • Blankgrabber family
  • Detect Xworm Payload 1 IoCs
  • Xworm family
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • VapeV4-crack-loader-main.zip
    .zip
  • VapeV4-crack-loader-main/README.md
  • VapeV4-crack-loader-main/bin/dllhandler/dll-ghw.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • VapeV4-crack-loader-main/bin/dllhandler/dll.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • VapeV4-crack-loader-main/bin/exe/dll/Guna2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • VapeV4-crack-loader-main/bin/exe/exec/g-build.exe
    .exe windows:5 windows x64 arch:x64

    1af6c885af093afc55142c2f1761dbe8


    Code Sign

    Headers

    Imports

    Sections

  • '���[email protected]
  • VapeV4-crack-loader-main/bin/exe/exec/r-build.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • VapeV4-crack-loader-main/crashhandler.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • VapeV4-crack-loader-main/how-to-use.txt
  • VapeV4-crack-loader-main/netform.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • VapeV4-crack-loader-main/vape-loader.bat