General
- Target VapeV4.exe
- Size 68.7MB
- Sample260622-rplejacy2m
- SHA256 33c33419706022b6f8ae712ca226b3813dd30461faa6fd6b5142358516795adf
Malware Config
Targets
-
- Target VapeV4.exe
- Size 68.7MB
- SHA256 33c33419706022b6f8ae712ca226b3813dd30461faa6fd6b5142358516795adf
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.8MB
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
Score4/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.8MB
- SHA256 9db39b8556ef7cd73a8f600c931b833fba4be852f9af388795768d2d8df85806
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libEGL.dll
- Size 477KB
- SHA256 f1430eb55200da71a1d4be09c4f17b4c04f17ab87ca1b2b3a114592e3ea8044a
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 be6bc168af3bd1aa9a54f46f4c63043c8a9894247699957a46c96fdca646aac0
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vgcbypass.exe
- Size 164.6MB
- SHA256 e3bea39bd97b952992f567dde6b577093327cd96450e7e2fd5b0947160540262
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
- Target vk_swiftshader.dll
- Size 4.9MB
- SHA256 10411f9a38ee2df37d8f12fc8adb47eb653abff5b3cd8a80260ff55490698a21
Score1/10 -
- Target vulkan-1.dll
- Size 931KB
- SHA256 982d9aedc579a34035e15b3a425e605676937843e65f3b7157f805d434902ca6
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1