Behavioral task
behavioral1
Sample
Mercurial_Grabber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Mercurial_Grabber.exe
Resource
win10v2004-20240412-en
General
-
Target
Mercurial_Grabber.exe
-
Size
147KB
-
MD5
646de794b55745c14c3dce0e1b30a2c1
-
SHA1
0a485f590a54bdc38848e82aa7429919e7132013
-
SHA256
c49470b4ee54a78fd1b8215642a0afc43799679581d85bd2099e3c534a7136f5
-
SHA512
66b7051ec4e280fe35393b1c3799af2e60f4cef249304ee4755ee7e0ffa1331ffc6bc49a5bfc0e9414825a60cd20ccf340c44d6243831e5e075985f67368f192
-
SSDEEP
768:ooNreY8YmjRFZomMLuZiLoLTjbKZKfgm3EhKhJegFH4MkaL5PEs:oLYm7RKLoLTXF7EIhnH4QL5cs
Malware Config
Extracted
mercurialgrabber
https://discordapp.com/api/webhooks/899427633924812880/W3wY7LN9luaz60TtoWHm0BKP65w6rvbYJqJA6YRfJp9wFxpNa30cIOFEEAkr56QFwZkK
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Mercurial_Grabber.exe
Files
-
Mercurial_Grabber.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ