General
- Target VapeV4.exe
- Size 68.7MB
- Sample260825-qjtchssgja
- SHA256 552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663
Malware Config
Targets
-
- Target VapeV4.exe
- Size 68.7MB
- SHA256 552546f5647b712959d49faa74307417dae80145ae04cfeaaa79a643fd57b663
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Executes a VBScript file via the Windows Script Host.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
Score1/10 -
- Target LICENSES.chromium.html
- Size 8.8MB
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
Score3/10 -
- Target SkinChanger.exe
- Size 164.6MB
- SHA256 78a61996bd994b921ba345bc1c7d9b4b53bf2e2386fa55196c39ebf0ac4d7c8e
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Executes a VBScript file via the Windows Script Host.
-
- Target chrome_100_percent.pak
- Size 132KB
- SHA256 86f6b8ffa8788603a433d425a4bc3c4031e5d394762fd53257b0d4b1cfb2ffa2
Score3/10 -
- Target chrome_200_percent.pak
- Size 190KB
- SHA256 8c1ae81d19fd6323a02eb460e075e2f25aba322bc7d46f2e6edb1c4600e6537a
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.8MB
- SHA256 9db39b8556ef7cd73a8f600c931b833fba4be852f9af388795768d2d8df85806
Score1/10 -
- Target icudtl.dat
- Size 10.2MB
- SHA256 f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
Score3/10 -
- Target libEGL.dll
- Size 477KB
- SHA256 f1430eb55200da71a1d4be09c4f17b4c04f17ab87ca1b2b3a114592e3ea8044a
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 be6bc168af3bd1aa9a54f46f4c63043c8a9894247699957a46c96fdca646aac0
Score1/10 -
- Target resources/app.asar
- Size 32.6MB
- SHA256 fcdffe9050a2a28464b77215aabfd473ca44fa6fc1902c227f9a5c7acff71918
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target snapshot_blob.bin
- Size 261KB
- SHA256 b21d129deaff12c8e2ec7eb50e8318a5937a11523b2d63bfc676285e2fa382d6
Score3/10 -
- Target v8_context_snapshot.bin
- Size 611KB
- SHA256 40d955781ef6cdbc58ddfdf77839fb8750af31ce000b24c1380d3127868df038
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
3System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1