Extracted

• • Target
    Vape V4.21/Python Numpy Installer.bat
  • Size 217B
  • SHA256 9307f0dea15d0608a870ba75137e9bebe9633a8e2c7fb5720e4d715bd7b2d730
  • MD5 729e49be9aa9c748047d23b892885009
  • SHA1 7e6646b4a44085694ae8d2b27f6369874bae51c9
  • SHA512 46de0fcd49af3a1094f52374df0baf1970d0857fa5617900000a1dd4946b093d7326aaf1df883dc2a4e7a4c6451843a57fc5e842e4abb843fadf8182d7d69e5c
  • TLSH
    T13FD0236F10F015B5AC280F04D37710C3378F1483123A7742509F455975C6C27F21A37A
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral1behavioral2
• • Target
    Vape V4.21/Python PIPs Installer.bat
  • Size 223B
  • SHA256 f137d19fad6043d90b7db03346f1021b10d719eb1961d76e9f32cc5584fe0153
  • MD5 70c0fa461015c7341d0d8b2ff4a4bdbd
  • SHA1 e223294f552f9effc6408d58357fa4b53d2d222c
  • SHA512 ad3261cae10fd967a76e09ef3cf0ed02b238c217626a6cf9fc338c11ee199484b5b0dcac0e3dc515f223a4e8c28b25d1b46a1a5ec0d4d63345165aa956a5f9cd
  • TLSH
    T1E3D0A75F50B029B198540F15C36700D2378F94832239A641919E86AA6186C17E20A36A
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral3behavioral4
• • Target
    Vape V4.21/Server.py
  • Size 31KB
  • SHA256 c794727f4c282e15d86356f1eb67196fea0cc208ed1fd60358bef6cb99d52843
  • MD5 a6b6abf1c1f9311777c45032226b4824
  • SHA1 3a7fa299b407e2564dc117d78ef4a3916c9c2274
  • SHA512 c462e769f53fc82ab0b62c3ef45bf7525be13610e0535abe2175ee55f7602447d2c76e9504d0127309d6c2f760fd87997696b14d18f2f82d05dd78a938748be0
  • SSDEEP 384:kvWx6kmOKS2y68HjOd6aYtk3wf8Ukkx3cA6mM:kOf2MS6kAfukNcAs
  • TLSH
    T15CE29742CCB64C6168328B5DCC55D012F33487A79B357406FB7C9DDCEF358AA93A0AA8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral5behavioral6
• • Target
    Vape V4.21/Vape V4.21.exe
  • Size 189KB
  • SHA256 0a0189197d9522e2e8c6ba806134bdd470c439912510e1b7db35d1e773484948
  • MD5 90c18692bbb7d58ed5bcf102aa2996e3
  • SHA1 aa79339b3c7eba7b2438a3d78b9eccca2ab9efce
  • SHA512 375f5288800261f3a84df3366d7ca41bfbd0b9b3c9152c535c4b36382924ed09757c2cf85b062336431ce9127db12ba0815c97a6aa3a5adcbb9cc274329104bf
  • SSDEEP 3072:x+AIC6iee4xc7I+g4A9PtLmMf8noNM3MWQ/s17LVHEEPX9p8lt1WkXBkrY1SZbBz:xGC6iee4xUZA9Pt6Mf8noNM3MWQ/s177
  • TLSH
    T10F140A0813ACCB23F77F5FB89A759292D772B607D84AF74E1C8890E834A2F515484B67
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionspywarestealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral7behavioral8
• • Target
    Vape V4.21/dumper/mitm_server.py
  • Size 4KB
  • SHA256 bc130c050da31bc55f7d6aa1c7a7e0817f289fa0eaf72ffa253cbaa10c45aff7
  • MD5 fb2ea3294517bab463df4273e7c6bcd6
  • SHA1 1a5eb75bff26c1d8a8cfefa57a8ea7fe366b7546
  • SHA512 ef56b9000dca93f34a5badb94299f27cd0cca267decf9c99b60dfe7b60d5df748900da7a422882a80f0a26a552bcb0588298096aa56d80c2026e190da862dfa7
  • SSDEEP 96:I5kbEiPPT7JDOKVyqOeyJCA1B5FE9pWbWCGkBRP4:I5niPPT7JDP+eyJt1XFErWs84
  • TLSH
    T188914202DC6A07E5DB23D67AC822F009532C7DA79B48345E7B8C9FDC9F850775B62868
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral10behavioral9