mercurialgrabber | 03-08-2024_hYQnEY98kzONexB[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
03-08-2024_hYQnEY98kzONexB.rar
Size 380KB
Sample240803-eznanatapl
SHA256 98bb2f2e1e052cdc02ec4681bce66c95b72efb200d0c761e0e90e421d5887586
MD5 1f07cc38bc38349203b8cdc78572abe0
SHA1 a91a541c697818bf3201a526919a20b72516fd24
SHA512 81e140821385223e8474c514c2f20aeb6f1ae2c8396d380472654c1caf65365b73bd5759b883d4d8ca4f77f932b72f466098777bcf7c66b93f70cc88204d6dc1
SSDEEP 6144:yOXp7CS/4nU/wbrSqU7ewpvik/9Sr2wbDnc68gl1BlXtSgykbex8OPeC:yO87nUIfSJdpqk/oTRtSRkaBz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mercurialgrabber

Malware Config

Extracted

Family

mercurialgrabber

https://discord.com/api/webhooks/887304484844339250/sTQt9knbeiUf2bJPMZ4uxOEZ2mFmxtbw1S3JZvhKpMU-hSQtSzNllJidmjM8oJmI2wpt

Signatures

Mercurialgrabber family
mercurialgrabber

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ValoTestAndProof_Shift_trigger/files.exe
unpack001/ValoTestAndProof_Shift_trigger/mapper.exe

File Explorer

03-08-2024_hYQnEY98kzONexB.rar

.rar 380KB
ValoTestAndProof_Shift_trigger/!TUTORIAL! - READ!.txt

124B
ValoTestAndProof_Shift_trigger/RUN THIS.bat

31B
ValoTestAndProof_Shift_trigger/config.ini

70B
ValoTestAndProof_Shift_trigger/files.exe

.exe 403KB
ValoTestAndProof_Shift_trigger/mapper.exe

.exe 41KB

03-08-2024_hYQnEY98kzONexB.rar

SHA256 98bb2f2e1e052cdc02ec4681bce66c95b72efb200d0c761e0e90e421d5887586
MD5 1f07cc38bc38349203b8cdc78572abe0
SHA1 a91a541c697818bf3201a526919a20b72516fd24
SHA512 81e140821385223e8474c514c2f20aeb6f1ae2c8396d380472654c1caf65365b73bd5759b883d4d8ca4f77f932b72f466098777bcf7c66b93f70cc88204d6dc1
SSDEEP 6144:yOXp7CS/4nU/wbrSqU7ewpvik/9Sr2wbDnc68gl1BlXtSgykbex8OPeC:yO87nUIfSJdpqk/oTRtSRkaBz
MD5 SHA1 SHA512 SSDEEP

ValoTestAndProof_Shift_trigger/files.exe

IMPHASH 48e414e431433a62713440d22abb8343
SHA256 b069d5e6a936d6657115f9dd4a7d5ccdda2a900f15602b5dcb92518bc311578e
MD5 027b8ba0a18fda179fff69627d272306
SHA1 63ceccd2e616ebe0bca0ec38ba2bd936adfc6d4d
SHA512 4a2ef5b175fe187f565481b88b23f4c3cae17b785a2affca4fca6266491003c79160f0e6f9ad57ff95653ddf26ee4730218a53c3b043c9c399166cbf8b7b6826
SSDEEP 6144:985P82cN1cwpIfbkizrPNVbicAYnkhqkxe4Jo6vL4AXHydDSkhVqYsOJF/1+:98V8JpGQiPPacBnkhawoQni+YNJFw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

938774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ValoTestAndProof_Shift_trigger/mapper.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 24e33a4716587fc8f330f77da68493f52b46311cf0e87681dd35e4ce6b912e51
MD5 975e8aed42ef6368efd5a66204d4818a
SHA1 5d48ef440ba147a27dfa5236fcbf426a34a21e2a
SHA512 07ea3d9d56f897021858490da38ce84747e788c8c5a8b49e8d9c021e8b57a97a9d54efe851b06afc08bfc4687c374ad7d5d02baa94188ae3d0f13fd8727caee6
SSDEEP 768:TscG4ApfT6aGpDXswguZkeVWTjUHKZKfgm3Ehqt:IcKfnGEeVWTUF7EEt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

03-08-2024_hYQnEY98kzONexB.rar

ValoTestAndProof_Shift_trigger/!TUTORIAL! - READ!.txt

ValoTestAndProof_Shift_trigger/RUN THIS.bat

ValoTestAndProof_Shift_trigger/config.ini

ValoTestAndProof_Shift_trigger/files.exe

kernel32

wsock32

winmm

version

comctl32

psapi

wininet

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

ValoTestAndProof_Shift_trigger/mapper.exe

mscoree

dotnet