Behavioral task
behavioral1
Sample
Backup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Backup.exe
Resource
win10v2004-20230221-en
General
-
Target
Backup.exe
-
Size
43KB
-
MD5
d502bd9f621631f4dd9d183f32a67f1b
-
SHA1
44eb2210df5b1ace3a6d372fb6ffea439c8fbcdf
-
SHA256
9a7ee0da7ef655976cb5f252a35382353702a0dc6348fff380dd09e1b846d6f1
-
SHA512
10fdec17422a4106a7c7e389e30a936201213a781b04f8b69973bb8cbbdecabaef637610598e0db2257b3f8f29a93b3ec38365326ad7341be1c5f2765aa844b5
-
SSDEEP
768:VscaIiIVIr2iqrZ7qLwCuZoeAWTjyKZKfgm3Ehdg:Cc17Ir2i9reAWTGF7E7g
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1090791795652304946/WX5zGahNZXX84VN8XHERs0XBurvb3anuLVasfTDq-Zn2E90xIP4HsitB05tDZwcFktal
Signatures
-
Mercurialgrabber family
Files
-
Backup.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ