URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cmshotel.stay-app.com/sso/[email protected]&hash=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MjAyNjQ2OTQsImRhdGEiOiJyYWRoaWEuaGFtaXNAbWVsaWEuY29tfDE3MjA4Njk0OTR8MWIzZWI5ZDgwYjJlNDc3Y2ViNjg1MTQ1OTBmYTlmMWIzNjM4MDQ2NSIsImV4cCI6MTcyMDg2OTQ5NH0.foqDiTQNH_8hvdNByHU39Vbo_FENAubd4zOVUqheWZc&action=activate
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
https://cmshotel.stay-app.com/sso/[email protected]&hash=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MjAyNjQ2OTQsImRhdGEiOiJyYWRoaWEuaGFtaXNAbWVsaWEuY29tfDE3MjA4Njk0OTR8MWIzZWI5ZDgwYjJlNDc3Y2ViNjg1MTQ1OTBmYTlmMWIzNjM4MDQ2NSIsImV4cCI6MTcyMDg2OTQ5NH0.foqDiTQNH_8hvdNByHU39Vbo_FENAubd4zOVUqheWZc&action=activate
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
https://cmshotel.stay-app.com/sso/[email protected]&hash=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MjAyNjQ2OTQsImRhdGEiOiJyYWRoaWEuaGFtaXNAbWVsaWEuY29tfDE3MjA4Njk0OTR8MWIzZWI5ZDgwYjJlNDc3Y2ViNjg1MTQ1OTBmYTlmMWIzNjM4MDQ2NSIsImV4cCI6MTcyMDg2OTQ5NH0.foqDiTQNH_8hvdNByHU39Vbo_FENAubd4zOVUqheWZc&action=activate
Resource
macos-20240611-en
General
-
Target
https://cmshotel.stay-app.com/sso/[email protected]&hash=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3MjAyNjQ2OTQsImRhdGEiOiJyYWRoaWEuaGFtaXNAbWVsaWEuY29tfDE3MjA4Njk0OTR8MWIzZWI5ZDgwYjJlNDc3Y2ViNjg1MTQ1OTBmYTlmMWIzNjM4MDQ2NSIsImV4cCI6MTcyMDg2OTQ5NH0.foqDiTQNH_8hvdNByHU39Vbo_FENAubd4zOVUqheWZc&action=activate
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]