General

  • Target

    0x000b00000001230f-61.dat

  • Size

    41KB

  • Sample

    221030-vmr13sbbd7

  • MD5

    458168047894c09ae76b0add79c7122d

  • SHA1

    4e291744275e8e9006c15d03489e0b252592a817

  • SHA256

    99c506c6a6fbbf9d7ed9e20ed02dfb91be159f0f33498153ca2894731fe41949

  • SHA512

    fcdad8b12068cd6f1da8a6ab1cab610aa383a1f86aaf4523122e3ce0fd9ab7315fc6c239259860ab13dd83342c75c7aa18c997bc7eaefa445a77bdb7eb14ff61

  • SSDEEP

    768:TscG4ApfT6aSXpDXswouZkeiWTj/KZKfgm3EhzF:IcKfnSXceiWTbF7EJF

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/835255995735343134/XNe_EsIHeOwVdqPUaV7pv4uxkib5RHnv_Tn6JCr4hEBupeIfyQN2tRINJsXKij_tI_Ec

Targets

    • Target

      0x000b00000001230f-61.dat

    • Size

      41KB

    • MD5

      458168047894c09ae76b0add79c7122d

    • SHA1

      4e291744275e8e9006c15d03489e0b252592a817

    • SHA256

      99c506c6a6fbbf9d7ed9e20ed02dfb91be159f0f33498153ca2894731fe41949

    • SHA512

      fcdad8b12068cd6f1da8a6ab1cab610aa383a1f86aaf4523122e3ce0fd9ab7315fc6c239259860ab13dd83342c75c7aa18c997bc7eaefa445a77bdb7eb14ff61

    • SSDEEP

      768:TscG4ApfT6aSXpDXswouZkeiWTj/KZKfgm3EhzF:IcKfnSXceiWTbF7EJF

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Tasks