Behavioral task
behavioral1
Sample
Grabber v3.exe
Resource
win10v2004-20230220-en
General
-
Target
Grabber v3.exe
-
Size
41KB
-
MD5
12213302ea566673ab6907c47c39fe28
-
SHA1
8e22215aac5a72143543318d6f6d4990411ff0ef
-
SHA256
0ad6413f32bc574a585dd429a2159667c1bcf5c963f74880d1d19b06d1decde3
-
SHA512
167cc145f87598d0c13c9f969c459ca319927b1b89e748a2e288705c11e61d64bc6ee58f52e58b87666bfd35d66b9cfad1f6dac82030ee76c78103e15c2b6b5b
-
SSDEEP
768:kscaIiIJVEo8/yw4uZ9eYWTjZKZKfgm3EhXe:rc1jVErReYWT9F7EFe
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1086015599227961364/DVzjxey9xFfawOgBhOeVNXV8Tw9bBb_mfeomRk0dtGHg8L5j2xvn35APRjGjebrJX2Kk
Signatures
-
Mercurialgrabber family
Files
-
Grabber v3.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ