Behavioral task
behavioral1
Sample
ae3a20db60729e69b81814151b161e71219f1d8c14beb64a07f47fb2dde8f668.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ae3a20db60729e69b81814151b161e71219f1d8c14beb64a07f47fb2dde8f668.exe
Resource
win10v2004-20220812-en
General
-
Target
ae3a20db60729e69b81814151b161e71219f1d8c14beb64a07f47fb2dde8f668
-
Size
42KB
-
MD5
fb1456b3b636f053cbc957205e622607
-
SHA1
bac4d4141fa0f0b420d5d75cf4bbd7c35a03548e
-
SHA256
ae3a20db60729e69b81814151b161e71219f1d8c14beb64a07f47fb2dde8f668
-
SHA512
886a8f22ed9ce0ce73e81186fd4087c05a45f8314add4a64948d2695e8f51fdc3a6724ef83e52262dc8aa042b7583250b5366cf0d2e5721984cad1e25db57f28
-
SSDEEP
768:y/D0qZiQrpLvZ8DylO8zuZ4LdhTj6KZKfgm3Ehh6:y/Xj6D98zLdhTGF7Ej6
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/966426984483811329/h9kH3-zMx2IaYBP_aScVi8qsau6YfiO2LEMCiSy3BNCjWA1LqO6XZAd3itHvip1UBLpm
Signatures
-
Mercurialgrabber family
Files
-
ae3a20db60729e69b81814151b161e71219f1d8c14beb64a07f47fb2dde8f668.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ