General

  • Target

    Bilder Alina.exe

  • Size

    42KB

  • Sample

    221019-a3893sehdl

  • MD5

    bbc07e7f2983f25e8b0ce1035b817ca6

  • SHA1

    585d9ffe9e72238c88c70a5b14d37386c42f4402

  • SHA256

    640ef4bd63a995a853cc37fa2943718892af6ed6e5f6e45b128fd8291e0e279b

  • SHA512

    2e393abb95c1f0d479e3c7eeb1b06d20e4e08e9e3c6397b15882d3745a122ba5a166c93b5ebb023aa3185b2bd9b869aad30fae07796fcc3fbbfaa1f31f3d99ba

  • SSDEEP

    768:UCV+LvnDylOcLuZ4LM+Tj3KZKfgm3Eh0D:4jnD9cTLM+TjF7EiD

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/908796186750758912/Ktr-RRsUHVpyWYRHOXiOfL3CSmn-60ZObmFke6maRM5X1JWS9IFyH5Lp5xofy7Idpi9m

Targets

    • Target

      Bilder Alina.exe

    • Size

      42KB

    • MD5

      bbc07e7f2983f25e8b0ce1035b817ca6

    • SHA1

      585d9ffe9e72238c88c70a5b14d37386c42f4402

    • SHA256

      640ef4bd63a995a853cc37fa2943718892af6ed6e5f6e45b128fd8291e0e279b

    • SHA512

      2e393abb95c1f0d479e3c7eeb1b06d20e4e08e9e3c6397b15882d3745a122ba5a166c93b5ebb023aa3185b2bd9b869aad30fae07796fcc3fbbfaa1f31f3d99ba

    • SSDEEP

      768:UCV+LvnDylOcLuZ4LM+Tj3KZKfgm3Eh0D:4jnD9cTLM+TjF7EiD

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

7
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks