Overview

overview

10

Static

static

10

Image logg...er.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Image logger builder.exe

  • Size

    45KB

  • Sample

    220719-vhzv5afec9

  • MD5

    cffd55485827afdea2cebea8c9b12979

  • SHA1

    e226c66468a8900cf8cf0c10c0bdd0e5e3b9c1a3

  • SHA256

    5e9b770c22cc64c2fffea38b863932f4aab53da12840a106ea2db3f13cc24a27

  • SHA512

    15767f7bfefaa04b0ca4ad27b72b51c98c0964d4899b67eaf30fcc5d1e678a4e8bf947c096b07cb6971adbd14cbc03217893be5bfa515a1d2262fc0ff298663b

Score
10/10
mercurialgrabberevasionspywarestealer

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/949555464851570708/6eTYN3cZKWGVnOeDVOoSWEZ_WJh4Sw55wUgi5XKhtOI0-jwWTqRvcDozbbAh61IsIaTR

Targets

    • Target

      Image logger builder.exe

    • Size

      45KB

    • MD5

      cffd55485827afdea2cebea8c9b12979

    • SHA1

      e226c66468a8900cf8cf0c10c0bdd0e5e3b9c1a3

    • SHA256

      5e9b770c22cc64c2fffea38b863932f4aab53da12840a106ea2db3f13cc24a27

    • SHA512

      15767f7bfefaa04b0ca4ad27b72b51c98c0964d4899b67eaf30fcc5d1e678a4e8bf947c096b07cb6971adbd14cbc03217893be5bfa515a1d2262fc0ff298663b

    Score
    10/10
    mercurialgrabberevasionspywarestealer

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

      stealermercurialgrabber

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks