General
-
Target
4f7957ddc2eb9746e8f4b08443853af7ab88646bc251eda4179e59e9b5a4b7a6.exe
-
Size
632KB
-
Sample
220521-yhy6dadad4
-
MD5
76de4e69c2b7f0e24da66fb31d61286c
-
SHA1
907866ff100b30313c425ce0b12523668c507d0d
-
SHA256
4f7957ddc2eb9746e8f4b08443853af7ab88646bc251eda4179e59e9b5a4b7a6
-
SHA512
388e9ed2aab91b08f04fa17549286a158c8fbac93879125ce47b89fa37937508ac0ac7b6b91663ff90e5ccd4cc31f3a7052f060cf3d39eb5097ad770497e3462
Static task
static1
Behavioral task
behavioral1
Sample
4f7957ddc2eb9746e8f4b08443853af7ab88646bc251eda4179e59e9b5a4b7a6.exe
Resource
win7-20220414-en
Malware Config
Extracted
pony
http://amazinggrace2022.digital/grace/gate.php
http://amazinggrace2022.digital/path/gate.php
-
payload_url
http://amazinggrace2022.digital/grace/file.exe
http://amazinggrace2022.digital/grace/calculator.exe
Targets
-
-
Target
4f7957ddc2eb9746e8f4b08443853af7ab88646bc251eda4179e59e9b5a4b7a6.exe
-
Size
632KB
-
MD5
76de4e69c2b7f0e24da66fb31d61286c
-
SHA1
907866ff100b30313c425ce0b12523668c507d0d
-
SHA256
4f7957ddc2eb9746e8f4b08443853af7ab88646bc251eda4179e59e9b5a4b7a6
-
SHA512
388e9ed2aab91b08f04fa17549286a158c8fbac93879125ce47b89fa37937508ac0ac7b6b91663ff90e5ccd4cc31f3a7052f060cf3d39eb5097ad770497e3462
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-