552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663

Sharing

Copy URL Twitter E-mail

General

Target
VapeV4.exe
Size 68.7MB
Sample260802-t1985ssxev
SHA256 552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663
MD5 6f1e056461acd015fa479b9858f0f791
SHA1 d37bd203acaf1c74e2f81314f6bea032b98cff82
SHA512 e29b7e275184c2e5107753bc10a91c906eca14a7b6fe63f2018b7a23aa80106dbad85d3b15828484f6eec14fedd6f26efa821ad1126be9f5377ca61cf7d31e86
SSDEEP 1572864:J4gRhxekCDPmeCJQtiHfpDRbaEer2heiYYB/AvN08Wmln7:J481CDfhoHxDJaXkMI/INn57
TLSH
T1E3F7331D661E635EFC3DA6F798CD6789C31AFE5A0B9237354C28807AF918B7424CD206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  VapeV4.exe
- Size 68.7MB
- SHA256 552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663
- MD5 6f1e056461acd015fa479b9858f0f791
- SHA1 d37bd203acaf1c74e2f81314f6bea032b98cff82
- SHA512 e29b7e275184c2e5107753bc10a91c906eca14a7b6fe63f2018b7a23aa80106dbad85d3b15828484f6eec14fedd6f26efa821ad1126be9f5377ca61cf7d31e86
- SSDEEP 1572864:J4gRhxekCDPmeCJQtiHfpDRbaEer2heiYYB/AvN08Wmln7:J481CDfhoHxDJaXkMI/INn57
- TLSH
  T1E3F7331D661E635EFC3DA6F798CD6789C31AFE5A0B9237354C28807AF918B7424CD206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/app-64.7z
- Size 68.3MB
- SHA256 c3c7f9484150a203cc152af74fefa5dc595404d2ffb6feb5c62dd58871f8a1e9
- MD5 00e61a4350c02c9dfc3be8cdfb4ed31d
- SHA1 5df180c786aa09dcc804fb34edaa2e0e31cf7da3
- SHA512 4099bbe7930ff8e110e2a5f78220ec9c027e930566c5637d37a08455aa332a973d4bf50b8deb33454b91129223ba6c3af32a0ec8b9a3454151d9396d3f9f565b
- SSDEEP 1572864:34gRhxekCDPmeCJQtiHfpDRbaEer2heiYYB/AvN08Wmlx:3481CDfhoHxDJaXkMI/INnH
- TLSH
  T1B3F7331D661E635EFC3DA6E798CD6788C31AFE5A4F9237354C28847AF908B7424CD206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral10 behavioral9
- Target
  chrome_100_percent.pak
- Size 132KB
- SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
- MD5 a0e681fdd4613e0fff6fb8bf33a00ef1
- SHA1 6789bacfe0b244ab6872bd3acc1e92030276011e
- SHA512 6f6a1a8bfe3d33f3fa5f6134dac7cd8c017e38e5e2a75a93a958addbb17a601c5707d99a2af67e52c0a3d5206142209703701cd3fab44e0323a4553caee86196
- SSDEEP 3072:tezwJCGIekwf9W2bg3yhPaL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:tezw1Iek+42k3yMK18Gb0OV8ld0GecQJ
- TLSH
  T185D3D0D7B3F4EE7DCA6756F7A62540B1ECB386280691434B078BD8752A26748DCC8783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  chrome_200_percent.pak
- Size 190KB
- SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
- MD5 c37bd7a6b677a37313b7ecc4ff01b6f5
- SHA1 79db970c44347bd3566cefb6cabd1995e8e173df
- SHA512 a7b07133fa05593b102a0e5e5788b29488cb74656c5ee25de897c2ba2b2a7b05c0663ade74a003f7d6df2134d0b75f0ad25e15e9c9e0969e9453b7fc40b9f8bb
- SSDEEP 3072:ADQYaE/N6Mrvy/3JP29W2bg3yhPaafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+y:ADQYaSN6svyd242k3yxgx5GMRejnbdZR
- TLSH
  T1ED14E1C7A3B8DD7DC9670AB3662501F1ECB211395AB6525B03DFDC357A56BC888C8283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  icudtl.dat
- Size 10.2MB
- SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
- MD5 e0f1ad85c0933ecce2e003a2c59ae726
- SHA1 a8539fc5a233558edfa264a34f7af6187c3f0d4f
- SHA512 714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
- SSDEEP 196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
- TLSH
  T1B8B63803A2FB4EC2F9F76F31D8F452679527BD496E32805A11042F3B5C336908A65BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  locales/af.pak
- Size 446KB
- SHA256 2b7a1625342c2b34fd220dba6b416786595dbf625948f5be7ddc52bf7e7116d2
- MD5 6b8c0f6213208fe201ffc8218a51fc20
- SHA1 12bc414da10964c11c31a3a44f0a76352b94724f
- SHA512 9544568bae24a193f81ca84f5c4041d8c69f4b05c73ed5a4e216d4f3a948de8c28c66ef93d21e0c80763c13ff35197969cbf18d4759a0dc3e2f8c57ad56ade48
- SSDEEP 12288:+R2loaNOk0o+wZqSMKVQ2uM2Z12JynAyPIVfNdgSTCSQ2fs37KvOb5t/tn6Abiay:VDck0ofcSMaTuM2Z12JynAyPIVfNdgS3
- TLSH
  T19EA42C06DB91273D09A07696BB0846F7BF9CA26CD770B2BADD9D82360562EFC017D1C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  locales/am.pak
- Size 726KB
- SHA256 fd0d603e89b2514572f8c03f7479f395b2012bd5ccbeb89366b813e8f02a557f
- MD5 cad8ef0ed379d74fac45391c6dcbb14d
- SHA1 7085b80b08bf88ba5cb4d634f2e1a5be6a4f2b91
- SHA512 1f91700d06d30db22821a9ccbf1e743d1490588e0ccdef08fcb18d9444d75593e98ea35e5d69f20ac921bf4ae2b385cdf8f2e7610f0968be36dae78cfdc708be
- SSDEEP 12288:ewwXTZou7fVIx2TERZ3ej5dMNzLY5t9ZSVrBO0Pcx30jH8+F:epXTZlVIxJRZuj5dMNzLY5t9ZSVrBO0d
- TLSH
  T183F499547EF9F7570F8E8A19A4320E4E9594AD4652813C38C35AD3FC2B2EF1B4DDA218
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/ar.pak
- Size 793KB
- SHA256 c141fab5d80ef650198ee0e396d14f96cab75c39299e396788efaab5e8543e87
- MD5 a5b81a0af153899c92bf6966b778fafd
- SHA1 bf18447f668bd284bc37116a0e9018e446642cc2
- SHA512 693d94eda17ee0b3d9865557071b5632e15bfc3180f7c78195d961e5825ad13bc0f35645f0c2ea52d46a4cfe5815d06211a6d61ad9162851926c10e06e244ada
- SSDEEP 12288:zGnCr1B0h5/N/REWH4LzWvwU5Twik9b5uNiH+32qeTT:zECIER75D+w
- TLSH
  T19C059BE21B2984720B96DF0FD1E23668D872BD23EB4BFC3124934A2156D7513E74E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/bg.pak
- Size 827KB
- SHA256 bc7047b3d87646a5350cbdf983ea859b97a49a82e5a13d91ec1c410de6ee087b
- MD5 47891446a74834aabd2c5d6e5eea7c9a
- SHA1 0e0b36a3afda165df00f3bb10624e3d2591c15de
- SHA512 d4802b616779cd5a204be5fc439778afa86192aaea0b94cf10bde3afb2ef3774076c30e6aa5d6edbd3dd7368b9ae0401eab1d4e75bdae5d02774826b591bcb45
- SSDEEP 24576:64uChsqfaElYMdAs1axUjHh373Zj93aAK5kVDgQwRunpKd2ao51JqueRSnQFwN/e:64uChsqfaElYtUjHh373Z53a1kVDgQw3
- TLSH
  T13C0524A15B9A68DF0101F45F98087E093CEB94FE3FE7879241642DBD39F10B486BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/bn.pak
- Size 1.0MB
- SHA256 8ad04a66e23db319fe3195d1309569b9b35e65571c69376bf39a4e79460b557c
- MD5 bbd111c6479de0c6753e5e29a41ada10
- SHA1 eb29c2ba8ced9e060a1ae4efa435f9b4b273ef13
- SHA512 055b565c990cb2f5b21558595fc0968d99c102595aa9a53ece7be5a61d3c474c74daca7ad3c24d534e9ea2404350e71d9bbcb698353c202537f782c3db07e498
- SSDEEP 3072:Tc2mIp84RjQJFQPFESdYObWEKNm2EadKZ0ZfQ0/QeIyTEPukkBBbpUDDM5ciXldW:wbIqqVF9d9KN+2IyoPubBbf5FlI
- TLSH
  T15935EE209C6E91B2A8C5CDC9434C6370C5236E9B9B61F74DDC17A24938ADC3C8DADDB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/ca.pak
- Size 503KB
- SHA256 3666b428ed75fa7ad06d812fbfef6b7c9d80300da4bf1d8b0f78a52046c43f4d
- MD5 ba3a70c271a87c53d7f36483e11dd035
- SHA1 962680e8825ef25463658fc74b660d5315c3458e
- SHA512 b6a5764d70e9b2e55f2609477f1bb2d568ea7eb8e51ce7bdec54b6b5221646e5927db5bdac0e3bfe61542eba0109ac05b6a0a2c4788d3674511316c37ca992a6
- SSDEEP 12288:AuZS8LVt4Y7kcELygV3z5PAF4N3Mw2juwHzejm0t3lvq8E9oCRaIs3cmlLEY2CJX:3S8LvP4V8R2S9lMN4MZRg5/5Uiq
- TLSH
  T16DB409239FC93B6744D2320AFB46C217F48CA9847B06D254F5AE1B1622CCADCC677AD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  locales/cs.pak
- Size 517KB
- SHA256 359b49b141d15256b76cc1fa50eda0829abac7f0e8cc20e41455dd65e87e20e2
- MD5 208a0b0f999e2e835f986b062f7786bf
- SHA1 d76a82f148e8eb29ec384768ab1cd4648022f7d2
- SHA512 8e54294f8c58c9ed597e74a3c9c656977c59a051f3229b97029da5d082e8dd9a75b9ef1e3bc64e0964530b67dfcfe9b65a08d50ce6fcac377948aaf4aa45d6b4
- SSDEEP 12288:NH5FlUsvD1PyvJQ5QW50K8VPDNOQ3SCmPs:Fqw16vJ2950K8V5ObCmPs
- TLSH
  T15DB44A1EEEA26435888002497FBE4128BC1E83540B6FB5AB6CCF9D91217577ECEF4D58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  locales/da.pak
- Size 468KB
- SHA256 45f036a650bb91a3812646b8fac57df10956d75e1bdb85a8067cc16c7d56c428
- MD5 9aa3750deb43d8432ca826523a831f11
- SHA1 a8f97b978ea43f47b2c471bf6ec451901bd9ac7f
- SHA512 e4bba53992f482b75fc394d813dccd04f83fcec8e5040d640e37ef9ea3eba6d93feb96399bc174d2b74a6c37ff057272ecba2db02b8aa5f3bf0113134d3b6d7a
- SSDEEP 6144:TiOAtdgpzV0qV5cU3HVEs7a7wlTwUJwa7obRR2vJub5/NrXBDUd4vTGqfwI:TibkzHzaoQR5Vr3Tpz
- TLSH
  T14EA44A4B9C9C732F89AD4B65F3108DA7EB5D543CC680264FA5D8943A0ACFC6097BE1C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32