Overview

overview

10

Static

static

10

df31b3fc78...ec.exe

windows7-x64

10

df31b3fc78...ec.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df31b3fc7860b4eabb64b6673cf1fbb0b049dfe94e41d8d3c7e080fe6b1880ec

  • Size

    42KB

  • Sample

    220930-wfeylsece5

  • MD5

    14daead92b9de032a82fe69eb67ec4d0

  • SHA1

    cf25b43bd3b63d76b00f986c73f850cce781dcd2

  • SHA256

    df31b3fc7860b4eabb64b6673cf1fbb0b049dfe94e41d8d3c7e080fe6b1880ec

  • SHA512

    c9c9f3afdd27ed69f4de77f2a4280360bd5e2c47ab6fea1a5a601513b9666a647a8d981f1e9e14cad0ee007c742e3db35ed66832de50e8f187fd791fefc9884f

  • SSDEEP

    768:0moRgBZ6an8z5pDts+uZeL/GMTjyKZKfgm3EhbH:0mh1n8z5PseL/GMT+F7EBH

Score
10/10
mercurialgrabberevasionspywarestealer

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/946338467808428062/fmmZTEvI-K5ZRlswedTLLYiuPBYmwQGI4X7ryxFYBd_BclaBEyk1LxQQW5CDkKyFBx7m

Targets

    • Target

      df31b3fc7860b4eabb64b6673cf1fbb0b049dfe94e41d8d3c7e080fe6b1880ec

    • Size

      42KB

    • MD5

      14daead92b9de032a82fe69eb67ec4d0

    • SHA1

      cf25b43bd3b63d76b00f986c73f850cce781dcd2

    • SHA256

      df31b3fc7860b4eabb64b6673cf1fbb0b049dfe94e41d8d3c7e080fe6b1880ec

    • SHA512

      c9c9f3afdd27ed69f4de77f2a4280360bd5e2c47ab6fea1a5a601513b9666a647a8d981f1e9e14cad0ee007c742e3db35ed66832de50e8f187fd791fefc9884f

    • SSDEEP

      768:0moRgBZ6an8z5pDts+uZeL/GMTjyKZKfgm3EhbH:0mh1n8z5PseL/GMT+F7EBH

    Score
    10/10
    mercurialgrabberevasionspywarestealer

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

      stealermercurialgrabber

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

7
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks