Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20230220-en
General
-
Target
sample.exe
-
Size
42KB
-
MD5
d2b771ae67e6ea9071d7abcaad44af0c
-
SHA1
8be0b005b20916e4417d0059f40f43a695dae032
-
SHA256
448e5e5b79fedb94971a7c8aa17648957c104e33ebfef88e00e5346cfdf5a22e
-
SHA512
8246a2c1569793a5d755708bfa5b97099dca8a7c1a64c619011205ef6144c66f57875d7b28b3b8fb78c49f5f660253fefd7443a7f8b7ffcb9bf4026c2cb1d810
-
SSDEEP
768:8pIm4lMmdKxMMmpouZxLVvTj8KZKfgm3Ehod:+AdNHpDLVvTAF7Eed
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/871200834552217601/3ioyQs9uMzYEdeqHF6QSQikAGObF_g1Rw3lWdFJ97OJjLlFIxfEoxwCO82jMq2eKyM7E
Signatures
-
Mercurialgrabber family
Files
-
sample.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ