mercurialgrabber | working key[.]zip

General

Target
working key.zip
Size 18KB
Sample240329-k1eb2aed86
SHA256 434bee4e012adaf0088de6dbbd407b36e2dcdd5d6487d1b529492c8ffa2f82bc
MD5 db27edd4a5250217b6ced48c54f73a14
SHA1 d37756079e7748098896f398d8f9266c5ffebeff
SHA512 be724fc408d7c86ab96b8659ebab7d81fd45c18f811bc692aa02f813ef8a11e8609eb4198ecf8bb9da4a7f3acec99c3f6db351393d688a352f2db2ee9fd7cecb
SSDEEP 384:i+gLeUvwpwWFuG7kYLYBRMf6GAJKQ8NfL+nMf8tCi5FE8gm:JUQtuG7kYcsUMQC6Q8t9p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mercurialgrabber

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1223007453780775012/RmQhlmaS6I4pA1jXRQPJVPP5zpVjnzimQ1bM_90lRDIoExo4TSHsD7rxDV2WS0GJ9Ema

Signatures

Mercurialgrabber family
mercurialgrabber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/working key/working key/working key.exe

File Explorer

working key.zip

.zip 18KB
working key/working key/working key.exe

.exe 42KB

working key.zip

SHA256 434bee4e012adaf0088de6dbbd407b36e2dcdd5d6487d1b529492c8ffa2f82bc
MD5 db27edd4a5250217b6ced48c54f73a14
SHA1 d37756079e7748098896f398d8f9266c5ffebeff
SHA512 be724fc408d7c86ab96b8659ebab7d81fd45c18f811bc692aa02f813ef8a11e8609eb4198ecf8bb9da4a7f3acec99c3f6db351393d688a352f2db2ee9fd7cecb
SSDEEP 384:i+gLeUvwpwWFuG7kYLYBRMf6GAJKQ8NfL+nMf8tCi5FE8gm:JUQtuG7kYcsUMQC6Q8t9p
MD5 SHA1 SHA512 SSDEEP

working key/working key/working key.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ad2dc3e2cf9bbcff6fca8645731850e33d9f5dd19a2e864aa611c7e5cf50639b
MD5 ff14bb3b31fee2eab5895bf147692528
SHA1 2ee91155e0d48944c7bfc2345b0989d321d3b51e
SHA512 ba5daf2fb2de19bbc2b0f038d32e720297e7b3ccd3ddea30b023ea77bec97705e949c0590d8568865e27001e7be27c9d2cd8bdc42aa4e1029bac36fd4a6f2d14
SSDEEP 768:iuA5Ehi4//4MbuZAuL5vTjtKZKfgm3EhgZ:wE0aDsL5vTJF7EeZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

48222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

working key.zip

working key/working key/working key.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

working key.zip

working key/working key/working key.exe

mscoree

dotnet