General
- Target VapeV4.exe
- Size 71.5MB
- Sample260831-jtvvrsfc89
- SHA256 9b7bd778580ce6cbdab622971b13797a675e18671b5c7b460dfcd026543b94ee
Malware Config
Targets
-
- Target VapeV4.exe
- Size 71.5MB
- SHA256 9b7bd778580ce6cbdab622971b13797a675e18671b5c7b460dfcd026543b94ee
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 8.8MB
- SHA256 6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
Score3/10 -
- Target VapeV4.exe
- Size 164.7MB
- SHA256 596268f971f75bdebf05eefbc5155eb2cd4f130b3d97537407c53e2920921c4f
Score10/10-
Detects Novablight infostealer
-
Family: Novablight
Novablight is an infostealer written in NodeJS operating as a Malware-as-a-Service.
-
Modifies WinLogon for persistence
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Creates new service(s)
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.8MB
- SHA256 d863c8a26744703f2d12c674b45c87d8b34e21efce169d4797b57964d168b077
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libEGL.dll
- Size 477KB
- SHA256 662746a02930c151c5cab2b1167a56c6ca78b44028448fda91182147856edfed
Score1/10 -
- Target libGLESv2.dll
- Size 7.3MB
- SHA256 d5e1d7b8531a0f4ab576ba6f78d4c63b39186a2830d313c6695f0024c9ef627a
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/direct-synch-show/build/Release/DHmodule.node
- Size 229KB
- SHA256 e07d1223a781f9da0127444dc63d82e3c780fb786a532f54b42f732d2c6546c3
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/node-dpapi-prebuilt/bin/ia32/node-dpapi.node
- Size 97KB
- SHA256 edc30ffd6df0d75c97a2f341a44d1bfd812fb4de55d48b2b4ad2adff745d6582
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/node-dpapi-prebuilt/bin/x64/node-dpapi.node
- Size 136KB
- SHA256 042952fabdd38a3b84572bd8f5e4697152ce8491eb3fe620d2a140ef3d4330d5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/sqlite3/lib/binding/napi-v6-win32-unknown-x64/node_sqlite3.node
- Size 1.8MB
- SHA256 394cc5942a0589b3375ecbd30341c34ab1aa1741eae0818e90588ace0f020772
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 4.9MB
- SHA256 4488a958418227fbe6f64898c2f85eefd87fc9e46aea457233b38db8a86e944d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vulkan-1.dll
- Size 931KB
- SHA256 0d56a41bead58fd5fee44b2ee60485d4c80a3a639acc42cfc57c8e059078dfe0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
3Internet Connection Discovery
2Wi-Fi Discovery
1System Time Discovery
1