General

  • Target

    7e7fdda992ee5496837a3553b3fdf60a

  • Size

    41KB

  • Sample

    231226-vg3kmaecek

  • MD5

    7e7fdda992ee5496837a3553b3fdf60a

  • SHA1

    7ca7c88288afbf541825127bfd6ea6e46ac0d21d

  • SHA256

    9b7152d2053180c5d13f303ec815a437cc1d6f8d19a9cfb39e02741d7a3feab1

  • SHA512

    99a28517118ee6df71e2ad609338d9b6f795ff5cd27ef65e8d0c9f71a2b1632c4edda02da1686bef06c47f1682b3245b03a796b6a7137fd63eeb0ac590c56fa9

  • SSDEEP

    768:JscG4ApfT6aWpDXswAuZkexWTjQKZKfgm3EhNN:WcKfnWkexWTMF7E/N

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/868873062756548618/M7jr5VWJMFGIVUmSk7foumdHsHfjOS_MZWS_Pp_J4YkgYsVd8TPJU1URrMihfDokc1nl

Targets

    • Target

      7e7fdda992ee5496837a3553b3fdf60a

    • Size

      41KB

    • MD5

      7e7fdda992ee5496837a3553b3fdf60a

    • SHA1

      7ca7c88288afbf541825127bfd6ea6e46ac0d21d

    • SHA256

      9b7152d2053180c5d13f303ec815a437cc1d6f8d19a9cfb39e02741d7a3feab1

    • SHA512

      99a28517118ee6df71e2ad609338d9b6f795ff5cd27ef65e8d0c9f71a2b1632c4edda02da1686bef06c47f1682b3245b03a796b6a7137fd63eeb0ac590c56fa9

    • SSDEEP

      768:JscG4ApfT6aWpDXswAuZkexWTjQKZKfgm3EhNN:WcKfnWkexWTMF7E/N

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks