Behavioral task
behavioral1
Sample
Mercurial Grabber.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Mercurial Grabber.exe
Resource
win10v2004-20231215-en
General
-
Target
Mercurial Grabber.exe
-
Size
42KB
-
MD5
2bdec488e251d59626a3c0464e101929
-
SHA1
c458e8fe4e80a741f35813ce7c2aa2b28c9c7921
-
SHA256
15719fa156469648d2ea7b62a166d442e9e3ca29bcb22f541f13e04d5582dc89
-
SHA512
ce5424a7ce9e6480a84afcd09e84313b112a18512652d0e321e5690d5e67dc3cd3fdc6657db62dd27e8065f30503e619fa3a275127e441690aa81e356c3b1e9b
-
SSDEEP
768:PyOARyY8YU+7omMjuZiLsTTjaMKZKfgm3EhPB:FLYNCLsTTmMF7E9B
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/945387105146773544/HAPkyzqIoO7ttCOeGRCU1R9YCmdnF3zPb1ughGqmDeXcjnkJI7TEKWuZ5FgEpy3Ddb55
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Mercurial Grabber.exe
Files
-
Mercurial Grabber.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ