General
-
Target
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062
-
Size
210KB
-
Sample
221204-qdmmsafd5y
-
MD5
d6e999ba5c764d7ed13991e0217d34d4
-
SHA1
464ae06077160d868cf66372fe0e60caadb9686c
-
SHA256
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062
-
SHA512
c26916f392c25d8b6ba559a02cd9b0bc2f32ab2171b2238b9e7c2ed3724d36152465ae7dae6823c392c01ad928a1a6729d11ed24279f4396635b4668c48f4c2a
-
SSDEEP
1536:dAqbbIpvLAQTX4F7E95m/GvKBaxZkw244o1fl15BfInnNBU6r:dAqvIpvLfTIF7E95mkmab3HQnNB
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/899004465238130699/6DAm1CSZiObBsDBDzW3u_AaHOY5DCRtiE_AZo5SiCQGdhHBcZ-zlYuITciuQR94YDk3C
Targets
-
-
Target
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062
-
Size
210KB
-
MD5
d6e999ba5c764d7ed13991e0217d34d4
-
SHA1
464ae06077160d868cf66372fe0e60caadb9686c
-
SHA256
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062
-
SHA512
c26916f392c25d8b6ba559a02cd9b0bc2f32ab2171b2238b9e7c2ed3724d36152465ae7dae6823c392c01ad928a1a6729d11ed24279f4396635b4668c48f4c2a
-
SSDEEP
1536:dAqbbIpvLAQTX4F7E95m/GvKBaxZkw244o1fl15BfInnNBU6r:dAqvIpvLfTIF7E95mkmab3HQnNB
Score10/10-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-