Skip to content
MalwareWiki

Malware

VaporRage

aka BOOMMIC

According to Mandiant, VaporRage or BOOMMIC, is a shellcode downloader written in C that communicates over HTTPS.

VaporRage, also known as BOOMMIC, is a Windows malware family operated by APT29.

Background

Mandiant describes VaporRage, also called BOOMMIC, as a C-based shellcode downloader that uses HTTPS for its communications. It pulls shellcode payloads from a hardcoded C2, identifying the host with an encoded host_id derived from the target's domain and account name. BOOMMIC then XOR-decodes the retrieved shellcode in memory and runs it.

Source: Malpedia (Fraunhofer FKIE).