Overview

overview

10

Static

static

10

Boris FX S...28.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Boris FX Saphire AE v19.6.28.exe

  • Size

    203KB

  • Sample

    240410-yd4kashf59

  • MD5

    21ce2adbe9c4ce28ac6b046ab37b410b

  • SHA1

    d71ce74e347fdab8dcdafd4d23d403dbcc9c1be6

  • SHA256

    c0289e36b3d5943c54c837d7b86e8bb5438413a503def4b12924eb0cf9ebaa14

  • SHA512

    e8917c5c4b441bad9f6af5f5cc3cf31a0390972b9638785dc5e919f640b45c46e5dc5b5a13cfece1486c4d8eba82b4f7e39f445da620140694c7a0b460df91f5

  • SSDEEP

    768:S8SXYLv+qylOcnuZwLEK1TjDKZKfgm3EhBWvsl7hj6SC:vPj+q9cDLEkTfF7E/WK7hHC

Score
10/10
mercurialgrabberspywarestealer

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1227702584115068959/XgeCFaD-3U7ddCVAnmrQPhTSrGgLYI_4tDJg864KEaNRJCAOV3hCE0qV8RoopEu1TPn0

Targets

    • Target

      Boris FX Saphire AE v19.6.28.exe

    • Size

      203KB

    • MD5

      21ce2adbe9c4ce28ac6b046ab37b410b

    • SHA1

      d71ce74e347fdab8dcdafd4d23d403dbcc9c1be6

    • SHA256

      c0289e36b3d5943c54c837d7b86e8bb5438413a503def4b12924eb0cf9ebaa14

    • SHA512

      e8917c5c4b441bad9f6af5f5cc3cf31a0390972b9638785dc5e919f640b45c46e5dc5b5a13cfece1486c4d8eba82b4f7e39f445da620140694c7a0b460df91f5

    • SSDEEP

      768:S8SXYLv+qylOcnuZwLEK1TjDKZKfgm3EhBWvsl7hj6SC:vPj+q9cDLEkTfF7E/WK7hHC

    Score
    10/10
    mercurialgrabberspywarestealer

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

      stealermercurialgrabber

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks