top title background image
flash

MVng2nP3xU.exe

Status: finished
Submission Time: 2024-05-16 15:47:07 +02:00
Malicious
Trojan
Spyware
Exploiter
Evader
Nightingale Stealer

Comments

Tags

  • 32
  • exe
  • PhemedroneStealer
  • trojan

Details

  • Analysis ID:
    1442643
  • API (Web) ID:
    1442643
  • Original Filename:
    fc505b7730fbbdead6d352aba01d6a18.exe
  • Analysis Started:
    2024-05-16 15:47:07 +02:00
  • Analysis Finished:
    2024-05-16 15:58:59 +02:00
  • MD5:
    fc505b7730fbbdead6d352aba01d6a18
  • SHA1:
    aa28e00c57c2a9a8638c777bb90f1f1528d359bb
  • SHA256:
    3cbfe1e9bba7469a3fd606dcf77b047570f4b9a37c02b055f2ab0416773424b4
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 47/73
malicious
Score: 26/38
malicious

IPs

IP Country Detection
208.95.112.1
United States
149.154.167.220
United Kingdom
8.8.8.8
United States

Domains

Name IP Detection
ip-api.com
208.95.112.1
api.telegram.org
149.154.167.220

URLs

Name Detection
https://api.telegram.org
https://api.telegram.org/bot
https://api.tele
Click to see the 10 hidden entries
http://ip-api.com/json/?fields=11827
https://api.telegram.org/bot6884699661:AAGPbkqESYn7iH7c6q7YuTlciwwO2tHQev0/sendDocument
http://ns.adobe.hotosh
https://g.live.com/odclientsettings/Prod/C:
https://api.telegram.org/bot6884699661:AAGPbkqESYn7iH7c6q7YuTlciwwO2tHQev0/sendDocumenttates
http://ns.a.0/sTy
https://g.live.com/odclientsettings/ProdV2.C:
http://upx.sf.net
http://api.telegram.org
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Dropped files

No malicious files found. See full and IOC report for all dropped files.