Behavioral task
behavioral1
Sample
ca25d0141cc9f970b141ac32ba7cf04f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ca25d0141cc9f970b141ac32ba7cf04f.exe
Resource
win10v2004-20240226-en
General
-
Target
ca25d0141cc9f970b141ac32ba7cf04f
-
Size
41KB
-
MD5
ca25d0141cc9f970b141ac32ba7cf04f
-
SHA1
79e34290aea916240880bcbff5536ebc61797a9c
-
SHA256
12caeca4b39c98392122d1d498cbd75cc3d61a03cc4cf13667b6820afd054a30
-
SHA512
f268f2309df3c90877a8a85d999f76edbedfc587a50868a40ea9587f6c8d208eb242963b884aa954a8165f8ef6d696d52b78d030cda962ec67c043e6b0575514
-
SSDEEP
768:VscG4A1aBYQSwXuZPevWTj7KZKfgm3EhEa:Cc5YevWT/F7E6a
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/879322421558136853/4bZPKyglx8VaNgvJUw-6zmAoViuYIA4z0HCzk2nvq5aqawU2Qmj3tJbc2o0ZE4C8hRc-
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ca25d0141cc9f970b141ac32ba7cf04f
Files
-
ca25d0141cc9f970b141ac32ba7cf04f.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ