General
- Target VadosAppInstaller.msi
- Size 34.1MB
- Sample260530-wbfpcaav2s
- SHA256 266027be207fb9faa0096c64d01272fc9910faa06bd90fce98f7adb58f0ef2b1
- MD5 cf1d7d07ebfb1104bbccce81737e38bd
- SHA1 c35cd16908f8be0abf00e0bc1d6687ba59306973
- SHA512 40500ae62ade60e71c6255e235aad0ad490a5b8fb93f933a2c7ea484cb15b9b2b95a0e87fe48ea27afb844dbe317c72a29640909dde144d1fd3c5a694c08b581
- SSDEEP 786432:Is9plrWX2047RRWMs7jFZMbFv58CqUFNlx9xL4pQtPBzsDQ:/t77Wxj7Mh58C5rEQtPB1
- TLSH T1B8773304BC868762E63347722A57D72BD7524F2093994C7FE240B7287A73AB50ED8CB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VadosAppInstaller.msi
Resource
win10v2004-20260513-en
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
VadosAppInstaller.msi
Resource
win11-20260513-en
21 signatures
150 seconds
Malware Config
Targets
-
- Target VadosAppInstaller.msi
- Size 34.1MB
- SHA256 266027be207fb9faa0096c64d01272fc9910faa06bd90fce98f7adb58f0ef2b1
- MD5 cf1d7d07ebfb1104bbccce81737e38bd
- SHA1 c35cd16908f8be0abf00e0bc1d6687ba59306973
- SHA512 40500ae62ade60e71c6255e235aad0ad490a5b8fb93f933a2c7ea484cb15b9b2b95a0e87fe48ea27afb844dbe317c72a29640909dde144d1fd3c5a694c08b581
- SSDEEP 786432:Is9plrWX2047RRWMs7jFZMbFv58CqUFNlx9xL4pQtPBzsDQ:/t77Wxj7Mh58C5rEQtPB1
- TLSH T1B8773304BC868762E63347722A57D72BD7524F2093994C7FE240B7287A73AB50ED8CB5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Defense Evasion
Subvert Trust Controls
1SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Msiexec
1