Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240709-en
General
-
Target
main.exe
-
Size
41KB
-
MD5
1376ca3331a572011802d014bd08230d
-
SHA1
e5b7e5b818f7782a417deef0e82ab90905b5e804
-
SHA256
276680ca48b7ed3b2d66785994c277ed43489f794f33ab50bc228d3735fbf87d
-
SHA512
8ad147272cdec3d745ef537b6dc6af1bf4f57595e83f9d2576120ceb050d3255ca7fca07937f1e87b0c59a33da6636c5ad188bd7fe6b2246022363f472a51a44
-
SSDEEP
768:DscaIiIde8/o5M/BgwGuZAegWTjTQKZKfgm3EhbZ:Yc1Xe8hOegWTQF7ExZ
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1267155504807809044/MO_j6kNKEqhxkpUWBV5u4GUzyy_k0_RrISBuadodAGvRK7ovoI0WSOWJ9MeIuvEEiXfG
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource main.exe
Files
-
main.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ