General
-
Target
7752e861758ed90e3d216218817ca1ea
-
Size
3.9MB
-
Sample
231222-hw8c7sddb6
-
MD5
7752e861758ed90e3d216218817ca1ea
-
SHA1
9e37aa0312542ca690a366ed851c4cc8892a5c22
-
SHA256
6632f776411838cec8cfa3ed78e71f0aca53931ce5c58c829cd852d0268d072d
-
SHA512
9053b53c3de5cbb4982dc75f818bb78d5595c77fd8e8bb53e8c616be5393c7c7b0b679abcd20f0a05313ade5e1423178c5206a091c5fe0a37aca4ef9cac63d23
-
SSDEEP
49152:YaLWbzU85xMQg3Q3cX5C/wnvdAlPjcmY38SglW4+6vRI7:YaSI85Y2RI
Static task
static1
Behavioral task
behavioral1
Sample
7752e861758ed90e3d216218817ca1ea.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7752e861758ed90e3d216218817ca1ea.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/884181755333079102/ERSKAoQxiKVr9JDm7vF8VbOPaqe1-BcEDg0p3uriXZ9aEtsmAC5vR_zQaDhYvujUm9uw
Targets
-
-
Target
7752e861758ed90e3d216218817ca1ea
-
Size
3.9MB
-
MD5
7752e861758ed90e3d216218817ca1ea
-
SHA1
9e37aa0312542ca690a366ed851c4cc8892a5c22
-
SHA256
6632f776411838cec8cfa3ed78e71f0aca53931ce5c58c829cd852d0268d072d
-
SHA512
9053b53c3de5cbb4982dc75f818bb78d5595c77fd8e8bb53e8c616be5393c7c7b0b679abcd20f0a05313ade5e1423178c5206a091c5fe0a37aca4ef9cac63d23
-
SSDEEP
49152:YaLWbzU85xMQg3Q3cX5C/wnvdAlPjcmY38SglW4+6vRI7:YaSI85Y2RI
Score10/10-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2