mercurialgrabber | 136ce1f5f2299e4f8e3fb5e30dc0f149[.]bin

General

Target
136ce1f5f2299e4f8e3fb5e30dc0f149.bin
Size 18KB
Sample240709-bdcp9axhnn
SHA256 c80787a356fa9f3b10141fc00097a954c9b950ab1211054ea6eeefa15e55b90c
MD5 53a8e08889c7449d7b0f4268ce0c6fd1
SHA1 455c0f533904580358103773c0275a6bb787e268
SHA512 d11bc0148b229f06ab96a706762573d36bd34be66e2f2c27ac78c0c60e9f6eb13ec4c7f545ab86ba98f777cc141ccd1f77f27c355a3eb7f8836e797712a046d6
SSDEEP 384:b6GG8qygI4NpI6mmBx8Qt75/mdWghU3s1eu/M8Q6mdPoc9w4l:tG8uIemmByc7tme8of8QJPx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mercurialgrabber

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1241448843959079032/HMgH2saTiZy9AeNAE4DxehoML8c_SJy5ub_JvUcxJk3wiNt3MyPnFu2k8elCddlfbFXT

Signatures

Mercurialgrabber family
mercurialgrabber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/68f01e0d0f2bf1705c62ad8b94d4454d2646aced975b56e593c59a58e4b0ccca.exe

File Explorer

136ce1f5f2299e4f8e3fb5e30dc0f149.bin

.zip 18KB
68f01e0d0f2bf1705c62ad8b94d4454d2646aced975b56e593c59a58e4b0ccca.exe

.exe 41KB

136ce1f5f2299e4f8e3fb5e30dc0f149.bin

SHA256 c80787a356fa9f3b10141fc00097a954c9b950ab1211054ea6eeefa15e55b90c
MD5 53a8e08889c7449d7b0f4268ce0c6fd1
SHA1 455c0f533904580358103773c0275a6bb787e268
SHA512 d11bc0148b229f06ab96a706762573d36bd34be66e2f2c27ac78c0c60e9f6eb13ec4c7f545ab86ba98f777cc141ccd1f77f27c355a3eb7f8836e797712a046d6
SSDEEP 384:b6GG8qygI4NpI6mmBx8Qt75/mdWghU3s1eu/M8Q6mdPoc9w4l:tG8uIemmByc7tme8of8QJPx
MD5 SHA1 SHA512 SSDEEP

Password

infected

68f01e0d0f2bf1705c62ad8b94d4454d2646aced975b56e593c59a58e4b0ccca.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 68f01e0d0f2bf1705c62ad8b94d4454d2646aced975b56e593c59a58e4b0ccca
MD5 136ce1f5f2299e4f8e3fb5e30dc0f149
SHA1 29460774476d4667f63a6abb5bcb29f603471589
SHA512 af5d31d017c155bb0043603de76a8a822a25d8a573d9bc87c549fd823c0ab33d42ede18dafb142cc6a3121441767075cd6d61c08cffa458fa91fd493b3cee4d9
SSDEEP 768:2scaIiIqfT6ajQdpDXsw7uZ7ejWTjvBKZKfgm3Ehzm:Vc1ofnI6ejWTbBF7EBm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

47774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

136ce1f5f2299e4f8e3fb5e30dc0f149.bin

68f01e0d0f2bf1705c62ad8b94d4454d2646aced975b56e593c59a58e4b0ccca.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

136ce1f5f2299e4f8e3fb5e30dc0f149.bin

68f01e0d0f2bf1705c62ad8b94d4454d2646aced975b56e593c59a58e4b0ccca.exe

mscoree

dotnet