General

  • Target

    https://objects.githubusercontent.com/github-production-release-asset-2e65be/372400866/1805b100-c56f-11eb-8787-63d3c4252d0e?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230506T171622Z&X-Amz-Expires=300&X-Amz-Signature=c2987450c1ffdd75c1989ca3dab1bd9af84848b337efa4846fb1c83366919f33&X-Amz-SignedHeaders=host&actor_id=67916528&key_id=0&repo_id=372400866&response-content-disposition=attachment%3B%20filename%3DMercurial.Grabber.v1.03.rar&response-content-type=application%2Foctet-stream

  • Sample

    230506-v5la9aab34

Malware Config

Targets

    • Target

      https://objects.githubusercontent.com/github-production-release-asset-2e65be/372400866/1805b100-c56f-11eb-8787-63d3c4252d0e?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230506%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230506T171622Z&X-Amz-Expires=300&X-Amz-Signature=c2987450c1ffdd75c1989ca3dab1bd9af84848b337efa4846fb1c83366919f33&X-Amz-SignedHeaders=host&actor_id=67916528&key_id=0&repo_id=372400866&response-content-disposition=attachment%3B%20filename%3DMercurial.Grabber.v1.03.rar&response-content-type=application%2Foctet-stream

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Looks for VirtualBox Guest Additions in registry

    • Downloads MZ/PE file

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v6

Tasks