General
-
Target
aa9ea7af64e96ff744ec5865d758e59c0daa9fe55d2bdfda77509c016fa76f1e.exe
-
Size
401KB
-
Sample
220521-yhy6dadad5
-
MD5
01d6f78bf20810ac59ef6acb2c19ef04
-
SHA1
a0d3ce444d8d95d4309cb4611bfa21dbd6380794
-
SHA256
aa9ea7af64e96ff744ec5865d758e59c0daa9fe55d2bdfda77509c016fa76f1e
-
SHA512
1e26f3ff8a46a3530b7b288631612cb8b7ffc155f155dd00b35b24eeb3319bbcfd32eec5dbd170d0217d08a35519b5eb0fd745a7bfdbc57421f2225035db59d9
Static task
static1
Behavioral task
behavioral1
Sample
aa9ea7af64e96ff744ec5865d758e59c0daa9fe55d2bdfda77509c016fa76f1e.exe
Resource
win7-20220414-en
Malware Config
Extracted
pony
http://amazinggrace2022.digital/grace/gate.php
http://amazinggrace2022.digital/path/gate.php
-
payload_url
http://amazinggrace2022.digital/grace/file.exe
http://amazinggrace2022.digital/grace/calculator.exe
Targets
-
-
Target
aa9ea7af64e96ff744ec5865d758e59c0daa9fe55d2bdfda77509c016fa76f1e.exe
-
Size
401KB
-
MD5
01d6f78bf20810ac59ef6acb2c19ef04
-
SHA1
a0d3ce444d8d95d4309cb4611bfa21dbd6380794
-
SHA256
aa9ea7af64e96ff744ec5865d758e59c0daa9fe55d2bdfda77509c016fa76f1e
-
SHA512
1e26f3ff8a46a3530b7b288631612cb8b7ffc155f155dd00b35b24eeb3319bbcfd32eec5dbd170d0217d08a35519b5eb0fd745a7bfdbc57421f2225035db59d9
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-