50bcee764e58a8fdcd525ac20bf0105d660aec2184f7ad0622cd0e7ceaef5c74

Sharing

Copy URL Twitter E-mail

General

Target
VapeLiteV3.4.2.zip
Size 12.8MB
Sample260801-w7vhdafa72
SHA256 50bcee764e58a8fdcd525ac20bf0105d660aec2184f7ad0622cd0e7ceaef5c74
MD5 7b2c093163211f33353a9c570fee01dd
SHA1 7379348a9f9896eccd3d1424b78a1e84516096f6
SHA512 2e3f2e1298d8da38a87031e187da064c0321b02ae0b49ee803ed53b619b201604e7f745dc0ddb599f089d4ee0fed2dae9defc3f8b2b3c1cdac8a77331ebe6bb0
SSDEEP 393216:iJVl/lMdTtGKv7/qY2wWOiSE+MSa4KtnLXi:iJLOWUyY2wZiqd6nu
TLSH
T15CD6334C92859366DDCD7AB0DF46FBA0C28618D9C767C7956EF03396BC124C07BAA093
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  VapeLiteV3.4.2.zip
- Size 12.8MB
- SHA256 50bcee764e58a8fdcd525ac20bf0105d660aec2184f7ad0622cd0e7ceaef5c74
- MD5 7b2c093163211f33353a9c570fee01dd
- SHA1 7379348a9f9896eccd3d1424b78a1e84516096f6
- SHA512 2e3f2e1298d8da38a87031e187da064c0321b02ae0b49ee803ed53b619b201604e7f745dc0ddb599f089d4ee0fed2dae9defc3f8b2b3c1cdac8a77331ebe6bb0
- SSDEEP 393216:iJVl/lMdTtGKv7/qY2wWOiSE+MSa4KtnLXi:iJLOWUyY2wZiqd6nu
- TLSH
  T15CD6334C92859366DDCD7AB0DF46FBA0C28618D9C767C7956EF03396BC124C07BAA093
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  LiteDLL.dll
- Size 2.9MB
- SHA256 06a77e962f6b954962f978e6fc6df61892df0cdb0ab1b1332d7dec6026cb2cbe
- MD5 6716db9e4d3f36bfaffe0e997fc741b7
- SHA1 c51a96fd26718a83775d91c623360985e0eaacd9
- SHA512 9490cfbc47161b9009dbbcde786e2494427423ed6b6ca5eb036f1453c180c152a77764d1c36f6ff42114c6553dbf5294720f926de6961097f43c64e1c263c2d9
- SSDEEP 49152:o/IjFTl0CD9tKSfCTRH0RU+mBhJp57o/Y7wjAzdIfxgRpe56h5L:X6zImho/Y7mAzdIJgRpe56hB
- TLSH
  T1BDD56DDF0179C3ACD23A563C520B563B8B6AB44AD726239BEBD740957B863C037B6311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Loader.exe
- Size 483KB
- SHA256 b190c31feb848ab27f3c060af3446f34818dc84cd27ebf282ed06c6534538c9c
- MD5 8726345d1e4a20b97e18f41bef97da28
- SHA1 e91b42df4b7bcab55bad603de8ce45e9cba40c53
- SHA512 030a479a7be18edfd9f5348cf2edf918c567e7cc245e54dd85b4ecf23bdf199108facebe55af3a8efae00f4aa6223552e600850f3c112668713e2514a470db0d
- SSDEEP 6144:m2LIW9DMeNzVdrNsBo6qtagQ8bIJmI1vFYCp/svoA21HK4txIFyMlMGhMg0510A3:mYMi7rCSH0mkmCp9796Fd9JI1N6H
- TLSH
  T164B4E096B3B643F8E0A78538C9511613E7B1785207119FEF43B48AB62F23AD61E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Patcher.dll
- Size 112KB
- SHA256 c25686a0747662a7b29d2e4c10115e899d8e576e5235ab0dd9a1edf783f98633
- MD5 e0b97233bd32c6e78131c03482e012d4
- SHA1 4cb708a48e5382c63be4e860299ae295690a8c41
- SHA512 ea783bbc4661dcf681c073fe50d44369ff0659c12f24ff311f6aa4a82b90a151005c54e7fa0e397200bb13b6fe6ba1353b5a850bfe789b26456d45beaf0395c6
- SSDEEP 3072:tEweyRHTCJ8ltNvHyFswt8nReO7uD39WD9:zeyhCOn0FsAnmEE
- TLSH
  T181B34B5B72E510BFE1728138C8674A45D7B6B82507609FEF53A042AA1F237D68D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  README.txt
- Size 866B
- SHA256 ff2e715d05a9eca9df681fa65db7f80b23f09b53b09673fb7227be4a633cd131
- MD5 9899c472d8608f1577dcc95f5b4b96e4
- SHA1 b32d191c8da786480c6dd96ee02caf46499822a4
- SHA512 1c6118794d6fdbf14eb3a4f07535340c916b510308493602089e415bdb2fe09bd50cd01423b6fb361e1a61a8477808091e83b6b0b6bc82e4c56192c6d9d6eee2
- TLSH
  T1DD11E3BE0B17C2AC5EB642E7229451A8FFB75073D08A92D9F539123832D182FC60090E
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  VapeLite.dll
- Size 11.5MB
- SHA256 074b284a14813185f5371025b1d94c1a95868c097487e08a538097564cc4afe7
- MD5 00e59dd6b0443d2726740e74277725a1
- SHA1 e6d2baeec5a695ec86be638cd55090d169ec8197
- SHA512 8dea3157ead4f0a91f7f3f1ffdf301cdf2701600bee6aa3712bc794cb80b6c17405ab2af602022cedd803ced06705cdad2aca3a76cf31920ccab33f500828011
- SSDEEP 196608:qD5lPm6XEAtvfFzwDJ1ckRrgL02VncjU96xpnbPtvvkwaUYGNo:q1ltUABQJjC1KYgpn2waUG
- TLSH
  T11BC6338B04A97FE3E85617BC941C2E52CD317A2B560A43FBFA0B4B71E64411ECF35269
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11 behavioral12
- Target
  mappings/mcp-notch-1.7.10.srg
- Size 2.0MB
- SHA256 8cbae8d2266b0b7e190311d9437e1c2b322585fb2814a9e5653ba530e313717d
- MD5 633c0039c7777b02bd3c9d7615ea4073
- SHA1 75fb39a9b4152e5bedfd17d82d345ea78be9b990
- SHA512 5c81af166222285e290c65df83658ee82d7efd0ac1b015a8449337e8e0e3b8db42c1e1e5bc3bb57e88d210ed72f46b6b64259aee2978f6cdf0b9daaff7705903
- SSDEEP 49152:E5F3iYaxrtusghV5HDSKKlONHdpBY2GDhI:k
- TLSH
  T19D958242D0CBBAE5797BF38BC4B0C551E5B0C3B36D5963ED7534481AFBE40C82296A68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral13 behavioral14
- Target
  mappings/mcp-notch-1.8.9.srg
- Size 2.6MB
- SHA256 c94374cb593b3aea6b016084c40160631c060a8ac6ca4136b3eeb32e0647ba86
- MD5 27a93893abfab13b27f018f010da0ee5
- SHA1 389d5f44b1e097ca5543e6f10fc89b7bdda5e14b
- SHA512 e193a5b737e8c78754d24cb8b4a041ed1797f4ced97770a4c3f08a7f467804ff7756e9ef1367e7724e53d74498ad74519a2a7d33028d7259106b5edd34027a3f
- SSDEEP 12288:nj2aTzVO4MYwzxW43ImkyLURIeTtP7AA+ukDRuDE7WCVdUbM4esIZDd3o:njtzVbMYwzxW43IJyKkNyesIZR4
- TLSH
  T1D0C57242D09BBAD6B97EF35BC4B0C510E5B0C3B36D1923ED7534881AFFE85C42296A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral15 behavioral16
- Target
  mappings/mcp-srg-1.12.2.srg
- Size 5.8MB
- SHA256 97505188486e4adb6e99012d3843a19f026691384ac8fb027b4111468f8cacd2
- MD5 8ae80048053a18fbb7d7a36c7185ccba
- SHA1 25d5ed4f63fb9259656b7d6a96494cf2795c9e68
- SHA512 ead0cbc3b10b1098536e4e16811465939a2ebabd7e3a57fd2d1d59aa889fbda99fe93c7217ae0821195cbba7c46e0b7cdcc17541b60a5f357c120022576f945e
- SSDEEP 49152:92GZGx0WT3ODnn8LARnDIugDImGTgF16tlL5VgbePN6finq5yURYdA5wrw8U190p:rv
- TLSH
  T167562E41D0EBBAD96D3EF74B88B08511E571D3B36E1E23ED7134891AFFD44C4228AA58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral17 behavioral18
- Target
  mappings/mcp-srg-1.7.10.srg
- Size 3.2MB
- SHA256 53507cd7ad8af57f324a6602e47c612f762a8560abcfc9a1ef0c9b1d18f61275
- MD5 64c70ea6fad1839d23059b0e4c1d7e0a
- SHA1 eab9733eb48b30248df46e70b205bdee638b0e5f
- SHA512 3e7b5a6bc505aedee11af525d3893d223bef806eb74811de95ecf635b73605def3b9a4af3b20224cb86a4b688d7938382add35e4690e36b5ee56046e21120cca
- SSDEEP 49152:E0qGCgFno9e/jV/0OvM56q5UnmIugDFpsFqW9Ydd5wrw8Ul:j
- TLSH
  T152F54142D0DBBAE5783EF74B84B08551E570C3B36E5E23ED7234481AFFE41C92296A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral19 behavioral20
- Target
  mappings/mcp-srg-1.8.9.srg
- Size 4.3MB
- SHA256 7b49dec303dfb850852ff67a37f51315f2a3657ddca31245fd40fe31f1177f8c
- MD5 a10d1ec5371105110b07acd5dc0139e9
- SHA1 ad07493c6108fd1d2f09514438d9dbaf770710cb
- SHA512 cf8dbdd549e0b99c00749a1c7c2cb339a5c9662c826db3c16861a0b1e8693f35dda285e737f73cd0d7cee8b1a4753fa3cc2e1f30014f662e490283cb4bae1c75
- SSDEEP 49152:mP5tLG7gpBpK/6GAUnmIugDjmJOzvYdd5wrw8UW:z
- TLSH
  T1EC263F42D0DBBAD9683EF70B88B08551E570D3B36E5E23ED7134891AFFD41C5228BA58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery execution
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22