mercurialgrabber | 3cba4eee46de013015a57f5953dbcff23376ff403b5905d729a3034ae9956e97

General

Target

image grabber.exe
Size

24.9MB
Sample

220722-cka1nsbgh3
MD5

61001bc6fff29e4c3672abbc1d62a510
SHA1

34382c9e151d4e4858733733f1092c79fdb8ca76
SHA256

3cba4eee46de013015a57f5953dbcff23376ff403b5905d729a3034ae9956e97
SHA512

cf90e22ed2653ebde64eb73012e57cc6a80e9bcc61af9138da33f0cb04435d55e920a6ade5b311c57c1c570147c00d96d3cf23846ffed9c44ce6556451695adb

Score

10^/10

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/999797870637105254/ly1zbOy9hfM2sNFROBmbUnuuo2bVfy7ZEX6boqlvK6HGjVET52RBtU68IcY8NzZ2gzzK

Targets

- Target
  
  image grabber.exe
- Size
  
  24.9MB
- MD5
  
  61001bc6fff29e4c3672abbc1d62a510
- SHA1
  
  34382c9e151d4e4858733733f1092c79fdb8ca76
- SHA256
  
  3cba4eee46de013015a57f5953dbcff23376ff403b5905d729a3034ae9956e97
- SHA512
  
  cf90e22ed2653ebde64eb73012e57cc6a80e9bcc61af9138da33f0cb04435d55e920a6ade5b311c57c1c570147c00d96d3cf23846ffed9c44ce6556451695adb
Score

10^/10

mercurialgrabber stormkitty evasion persistence pyinstaller spyware stealer suricata trojan upx
- Mercurial Grabber Stealer
  Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
  stealer mercurialgrabber
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- suricata: ET MALWARE NightfallGT Mercurial Grabber
  suricata: ET MALWARE NightfallGT Mercurial Grabber
  suricata
- Looks for VirtualBox Guest Additions in registry
  evasion
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Executes dropped EXE
- Looks for VMWare Tools registry key
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2