Overview

overview

10

Static

static

10

VapeV4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VapeV4.exe

  • Size

    12.0MB

  • Sample

    240728-cpceaswapf

  • MD5

    5f3fabec375e5a1acc1431477309ab48

  • SHA1

    c12fc1f9da09dd799601cc8c852cd742e6d2b32e

  • SHA256

    14a16b4fcb0af8c5fae891e060a5175f58c020a735be9e5a2242ac76c4327946

  • SHA512

    9b9567c649e98964949dc00a6865d0656c2fa600f294a654ef4264b48a6b34f0d3096c20603acafbb47c4e1568893078dc53c5a619a9b839fee434853bfb9d72

  • SSDEEP

    98304:DemvHzXnfpOfKEmZH0H7UpjSSJgEEjZoTsBbZAqSsraMh+QIUuoMOWucEZ8:DNHrxygH87BdjZ/JPraxzNo

Score
10/10
umbralcredential_accessdiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      VapeV4.exe

    • Size

      12.0MB

    • MD5

      5f3fabec375e5a1acc1431477309ab48

    • SHA1

      c12fc1f9da09dd799601cc8c852cd742e6d2b32e

    • SHA256

      14a16b4fcb0af8c5fae891e060a5175f58c020a735be9e5a2242ac76c4327946

    • SHA512

      9b9567c649e98964949dc00a6865d0656c2fa600f294a654ef4264b48a6b34f0d3096c20603acafbb47c4e1568893078dc53c5a619a9b839fee434853bfb9d72

    • SSDEEP

      98304:DemvHzXnfpOfKEmZH0H7UpjSSJgEEjZoTsBbZAqSsraMh+QIUuoMOWucEZ8:DNHrxygH87BdjZ/JPraxzNo

    Score
    10/10
    umbralcredential_accessdiscoveryexecutionspywarestealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks