General

  • Target

    an exe file.exe

  • Size

    42KB

  • Sample

    240815-kx2m6avdne

  • MD5

    84fef232765948eb3fe800c075d64aae

  • SHA1

    aa87e13ef08b5101e62423b0d2141b0836459568

  • SHA256

    72d81f64e67472c40e476981d1bb332aff4c2d54efaa13c46d44d65e4a276d73

  • SHA512

    aaad4d1cd287977c2c551c191029d9e2b22e348927f2088d4e795431d1f2f56ec545b50f76d1ca1386f607554869e32620291d9784ec859754f02442c8aea57c

  • SSDEEP

    768:xQNs4lMmcAimpnuZWLlFTjJTKZKfgm3EhZY:NAjpLLlFTtTF7EDY

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discordapp.com/api/webhooks/1273528799975178250/k3-e4i6IdHPaytIAwEwuS5hzRdRJWxyM-6BVPlRJ3eK7KJeyFPPofFqx5lS1TKYwcl9E

Targets

    • Target

      an exe file.exe

    • Size

      42KB

    • MD5

      84fef232765948eb3fe800c075d64aae

    • SHA1

      aa87e13ef08b5101e62423b0d2141b0836459568

    • SHA256

      72d81f64e67472c40e476981d1bb332aff4c2d54efaa13c46d44d65e4a276d73

    • SHA512

      aaad4d1cd287977c2c551c191029d9e2b22e348927f2088d4e795431d1f2f56ec545b50f76d1ca1386f607554869e32620291d9784ec859754f02442c8aea57c

    • SSDEEP

      768:xQNs4lMmcAimpnuZWLlFTjJTKZKfgm3EhZY:NAjpLLlFTtTF7EDY

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks