Behavioral task
behavioral1
Sample
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062.exe
Resource
win10v2004-20221111-en
General
-
Target
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062
-
Size
210KB
-
MD5
d6e999ba5c764d7ed13991e0217d34d4
-
SHA1
464ae06077160d868cf66372fe0e60caadb9686c
-
SHA256
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062
-
SHA512
c26916f392c25d8b6ba559a02cd9b0bc2f32ab2171b2238b9e7c2ed3724d36152465ae7dae6823c392c01ad928a1a6729d11ed24279f4396635b4668c48f4c2a
-
SSDEEP
1536:dAqbbIpvLAQTX4F7E95m/GvKBaxZkw244o1fl15BfInnNBU6r:dAqvIpvLfTIF7E95mkmab3HQnNB
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/899004465238130699/6DAm1CSZiObBsDBDzW3u_AaHOY5DCRtiE_AZo5SiCQGdhHBcZ-zlYuITciuQR94YDk3C
Signatures
-
Mercurialgrabber family
Files
-
af24afea10c8961f939f1013f9fa1d9ca6dafdb14b7968e1b721db6477082062.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ