General

  • Target

    7752e861758ed90e3d216218817ca1ea

  • Size

    3.9MB

  • Sample

    231222-hw8c7sddb6

  • MD5

    7752e861758ed90e3d216218817ca1ea

  • SHA1

    9e37aa0312542ca690a366ed851c4cc8892a5c22

  • SHA256

    6632f776411838cec8cfa3ed78e71f0aca53931ce5c58c829cd852d0268d072d

  • SHA512

    9053b53c3de5cbb4982dc75f818bb78d5595c77fd8e8bb53e8c616be5393c7c7b0b679abcd20f0a05313ade5e1423178c5206a091c5fe0a37aca4ef9cac63d23

  • SSDEEP

    49152:YaLWbzU85xMQg3Q3cX5C/wnvdAlPjcmY38SglW4+6vRI7:YaSI85Y2RI

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/884181755333079102/ERSKAoQxiKVr9JDm7vF8VbOPaqe1-BcEDg0p3uriXZ9aEtsmAC5vR_zQaDhYvujUm9uw

Targets

    • Target

      7752e861758ed90e3d216218817ca1ea

    • Size

      3.9MB

    • MD5

      7752e861758ed90e3d216218817ca1ea

    • SHA1

      9e37aa0312542ca690a366ed851c4cc8892a5c22

    • SHA256

      6632f776411838cec8cfa3ed78e71f0aca53931ce5c58c829cd852d0268d072d

    • SHA512

      9053b53c3de5cbb4982dc75f818bb78d5595c77fd8e8bb53e8c616be5393c7c7b0b679abcd20f0a05313ade5e1423178c5206a091c5fe0a37aca4ef9cac63d23

    • SSDEEP

      49152:YaLWbzU85xMQg3Q3cX5C/wnvdAlPjcmY38SglW4+6vRI7:YaSI85Y2RI

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks