Overview

overview

10

Static

static

10

ff393118bc...18.exe

windows7-x64

10

ff393118bc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff393118bc88560e5d0ac69ec5beef8c_JaffaCakes118

  • Size

    170KB

  • Sample

    240421-n4physaf96

  • MD5

    ff393118bc88560e5d0ac69ec5beef8c

  • SHA1

    111300b261311016035a8f5ba337131b4c723032

  • SHA256

    369c6acf41d605eb3e430f6201608a2e9e33ddbb98966ff1bc78729fd204f772

  • SHA512

    42be1542e953f061562d9478541c919a082060b77f0231504de321f072bdd5f2ebc7e9258f324eb6d9a293d9e30aeea9a6952f2df49aa8584eb494af0ed67074

  • SSDEEP

    3072:AEqretTBF7EuFQvn/Y2FMLajQyAJFLa/vi44:Qrbn/Y2FM+kDZqviB

Score
10/10
mercurialgrabberevasionspywarestealer

Malware Config

Extracted

Family

mercurialgrabber

C2

https://canary.discord.com/api/webhooks/882617809564233761/JQHqreMf4-hBQhfaGdeX22uMO6Ip4219CD5VU3iBKP-HmTO5pnyaKaFp3DaIZwfLSKOh

Targets

    • Target

      ff393118bc88560e5d0ac69ec5beef8c_JaffaCakes118

    • Size

      170KB

    • MD5

      ff393118bc88560e5d0ac69ec5beef8c

    • SHA1

      111300b261311016035a8f5ba337131b4c723032

    • SHA256

      369c6acf41d605eb3e430f6201608a2e9e33ddbb98966ff1bc78729fd204f772

    • SHA512

      42be1542e953f061562d9478541c919a082060b77f0231504de321f072bdd5f2ebc7e9258f324eb6d9a293d9e30aeea9a6952f2df49aa8584eb494af0ed67074

    • SSDEEP

      3072:AEqretTBF7EuFQvn/Y2FMLajQyAJFLa/vi44:Qrbn/Y2FM+kDZqviB

    Score
    10/10
    mercurialgrabberevasionspywarestealer

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

      stealermercurialgrabber

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

7
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks