General
- Target VapeV4.exe
- Size 68.7MB
- Sample260730-1j6mys1sat
- SHA256 552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663
Malware Config
Targets
-
- Target VapeV4.exe
- Size 68.7MB
- SHA256 552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Executes a VBScript file via the Windows Script Host.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.8MB
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
Score3/10 -
- Target SkinChanger.exe
- Size 164.6MB
- SHA256 78a61996bd994b921ba345bc1c7d9b4b53bf2e2386fa55196c39ebf0ac4d7c8e
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Executes a VBScript file via the Windows Script Host.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.8MB
- SHA256 9db39b8556ef7cd73a8f600c931b833fba4be852f9af388795768d2d8df85806
Score1/10 -
- Target libEGL.dll
- Size 477KB
- SHA256 f1430eb55200da71a1d4be09c4f17b4c04f17ab87ca1b2b3a114592e3ea8044a
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 be6bc168af3bd1aa9a54f46f4c63043c8a9894247699957a46c96fdca646aac0
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 4.9MB
- SHA256 10411f9a38ee2df37d8f12fc8adb47eb653abff5b3cd8a80260ff55490698a21
Score1/10 -
- Target vulkan-1.dll
- Size 931KB
- SHA256 982d9aedc579a34035e15b3a425e605676937843e65f3b7157f805d434902ca6
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
2Visual Basic
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
3System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1