MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0ccd705314d4c791edfee20ef9f99e056dc82775a42edd8653668a492b72a11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c0ccd705314d4c791edfee20ef9f99e056dc82775a42edd8653668a492b72a11
SHA3-384 hash:	3efb21d730c25743c27d9f897b2d78e3fded29687c76a119d44f7fe6acff74e4763283584c756fd8f10df251b9e1b357
SHA1 hash:	be83bb382d044f4c2ae8544eb29723cc46a73005
MD5 hash:	b2c1b5c91b5d5ba19d2eab3f9a7620be
humanhash:	nebraska-apart-gee-maine
File name:	VapeV4 2.1.1.msi
Download:	download sample
Signature	GenesisStealer Alert Create hunting rule
File size:	91'934'720 bytes
First seen:	2025-10-25 20:17:48 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:C3zgXSDsSvEezSu59ez5bIhsENPpNI79v5wFnplu6r6nmBA7UKRIcSXBTLIX/m:C3cRciz5wFNPP2xsTjSUKRI5RIX
TLSH	T10B18334D14401CB2E74EAA75053F073622775EA73A71683E7436B8E96BB33721E292C7
TrID	86.8% (.MSI) Microsoft Windows Installer (454500/1/170) 11.6% (.MST) Windows SDK Setup Transform script (61000/1/5) 1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	burger
Tags:	GenesisStealer msi

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

66

Origin country :

NL

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68fcf4893bdc93eb05643b18

Tags:

n/a

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug crypto fingerprint installer wix

Link:

https://www.filescan.io/uploads/68fd30a9acdc0d13837f0056/reports/b47a9884-a0d4-42ac-a0d7-e55be6ac1b5a/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/c0ccd705314d4c791edfee20ef9f99e056dc82775a42edd8653668a492b72a11

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

First seen:

2025-10-26T12:42:00Z UTC

Last seen:

2025-10-26T13:06:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-PSW.OLE2.Stealer.gen

Link:

https://opentip.kaspersky.com/c0ccd705314d4c791edfee20ef9f99e056dc82775a42edd8653668a492b72a11/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1801824

Signature

Drops large PE files

Excessive usage of taskkill to terminate processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Obfuscated command line found

Queries memory information (via WMI often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)

Queries sensitive system registry key value via command line tool

Sigma detected: Capture Wi-Fi password

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal WLAN passwords

Uses cmd line tools excessively to alter registry or file data

Uses netsh to modify the Windows network and firewall settings

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/c0ccd705314d4c791edfee20ef9f99e056dc82775a42edd8653668a492b72a11

CERT.PL MWDB

Gathering data

Neiki CloudSandbox.Malware.Generic

Verdict:

Malicious

Threat:

CloudSandbox.Malware.Generic

Link:

https://tip.neiki.dev/file/c0ccd705314d4c791edfee20ef9f99e056dc82775a42edd8653668a492b72a11

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ydgnobjrjvghshw75yqo7h4z4blnzatxljbo3wdfgzukjevxfiiq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Link:

https://tria.ge/reports/251025-y3pgnszqhm/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Browser Information Discovery

Event Triggered Execution: Netsh Helper DLL

Reads user/profile data of web browsers

System Network Configuration Discovery: Wi-Fi Discovery

Drops file in Windows directory

Executes dropped EXE

Hide Artifacts: Ignore Process Interrupts

Loads dropped DLL

Checks computer location settings

Enumerates processes with tasklist

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/fd93b87a-4de1-46b9-87a0-b7cff13d428c

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.