General
-
Target
LOLXD.exe
-
Size
42KB
-
Sample
230114-rafkqsch4t
-
MD5
e3d545e230f7e5bb4948716c63a8b851
-
SHA1
e25b168d3e9dd8eeafe6722c1fff7b8f4ecb2a64
-
SHA256
40d90e4a38dc265d047803df7e224f0d5d80fef69503296170e776213a3f6697
-
SHA512
d8309978995fba6bced265d98a2f716db74087cbcf46e42f10f518440122b7835fd8a5a76f336a0fad2b88d705509b8efc3f721749947072b88cd94f8c3aee76
-
SSDEEP
768:jE5jFn8rdgOpRTs+ZewuZ2Lf8lTjOKZKfgm3Ehmp:dxpRTNZZLf8lTaF7Ekp
Behavioral task
behavioral1
Sample
LOLXD.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
LOLXD.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1063818888372035674/Cr-rpmPnLJwltx1y4iKFbEtWHEItxwUz_xjBPlrsOtbWgXZr1elASq8XP6KoqAJY1NRu
Targets
-
-
Target
LOLXD.exe
-
Size
42KB
-
MD5
e3d545e230f7e5bb4948716c63a8b851
-
SHA1
e25b168d3e9dd8eeafe6722c1fff7b8f4ecb2a64
-
SHA256
40d90e4a38dc265d047803df7e224f0d5d80fef69503296170e776213a3f6697
-
SHA512
d8309978995fba6bced265d98a2f716db74087cbcf46e42f10f518440122b7835fd8a5a76f336a0fad2b88d705509b8efc3f721749947072b88cd94f8c3aee76
-
SSDEEP
768:jE5jFn8rdgOpRTs+ZewuZ2Lf8lTjOKZKfgm3Ehmp:dxpRTNZZLf8lTaF7Ekp
Score10/10-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-