mercurialgrabber | goooodoo[.]exe

General

Target
goooodoo.exe
Size 42KB
Sample230413-qlxsqabf56
SHA256 3a93a67357016486b5df7ddde6ef1e50f7417bd4f8c56026e6d6e51aee68ed0d
MD5 b00edf439268d41e538bd6e5e24461ab
SHA1 207e66420c80adebc715e2b17659fb5e276b7206
SHA512 c49c25fbf84aa170a89322dc03959ccbb5b1cc087aa41cb9831570162ebe42c2d38bd725c6a26e226f8c791e483eccfab275dade622653408aff03b6e7ff9b3e
SSDEEP 768:W09Vu8etQVom8QuZaLP9TjTKZKfgm3EhBm:WASQViALP9TPF7Ebm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mercurialgrabber

Malware Config

Extracted

Family

mercurialgrabber

C2

https://canary.discord.com/api/webhooks/1095796409367810268/oopXWByFcoXJIc_Ms3PP7ZYOARtU7F3Gr0EB-mkEj2bwvrANmbksOjuZKoZQWzLDBcor

Signatures

Mercurialgrabber family
mercurialgrabber

File Explorer

goooodoo.exe

.exe 42KB

goooodoo.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3a93a67357016486b5df7ddde6ef1e50f7417bd4f8c56026e6d6e51aee68ed0d
MD5 b00edf439268d41e538bd6e5e24461ab
SHA1 207e66420c80adebc715e2b17659fb5e276b7206
SHA512 c49c25fbf84aa170a89322dc03959ccbb5b1cc087aa41cb9831570162ebe42c2d38bd725c6a26e226f8c791e483eccfab275dade622653408aff03b6e7ff9b3e
SSDEEP 768:W09Vu8etQVom8QuZaLP9TjTKZKfgm3EhBm:WASQViALP9TPF7Ebm
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

48238

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing