mercurialgrabber | bde2ba59-239b-ec80-c564-17b1037f442c[.]zip

General

Target
bde2ba59-239b-ec80-c564-17b1037f442c.zip
Size 41KB
Sample240901-2dm44avalb
SHA256 fb200ebf103e46e21cb501e72f9f82ebff44664903fd97a1c7488ad562b7aac5
MD5 2c5e8e14b7fda2d9d43254e87b750c6f
SHA1 7de985339401cf0ed0f4455eae8b16ca9a993b60
SHA512 52d8f7681a7362a76fcac566e893f6f5d7e33ab1e01159c10d06f457eaf294c4bada0b24e9a459a06f8c1f04672a1c7aa95ffcc68e244d90e4c5e919b8329b24
SSDEEP 768:9scaIiID3mbWMABWawquZsezWTjgKZKfgm3EhfJUM:6c1N3mWM8WqezWTUF7EJJUM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mercurialgrabber

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1279557394677895311/Sw4EvWiW4SbcOzSCej18SukPQF-M_rfa5znh9fESXm95kIknSnlBrm_lJ_g-PFSoTKMc

Signatures

Mercurialgrabber family
mercurialgrabber

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mercurial.executor.v1.03.exe

File Explorer

bde2ba59-239b-ec80-c564-17b1037f442c.zip

.zip 41KB
mercurial.executor.v1.03.exe

.exe 41KB

bde2ba59-239b-ec80-c564-17b1037f442c.zip

SHA256 fb200ebf103e46e21cb501e72f9f82ebff44664903fd97a1c7488ad562b7aac5
MD5 2c5e8e14b7fda2d9d43254e87b750c6f
SHA1 7de985339401cf0ed0f4455eae8b16ca9a993b60
SHA512 52d8f7681a7362a76fcac566e893f6f5d7e33ab1e01159c10d06f457eaf294c4bada0b24e9a459a06f8c1f04672a1c7aa95ffcc68e244d90e4c5e919b8329b24
SSDEEP 768:9scaIiID3mbWMABWawquZsezWTjgKZKfgm3EhfJUM:6c1N3mWM8WqezWTUF7EJJUM
MD5 SHA1 SHA512 SSDEEP

mercurial.executor.v1.03.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 cd3434f7234e702d5be5327a7227743281e00caa4b3e4c09f43889ec3177b0e4
MD5 e8bd6fc19c460f8a5e45432de659a9a3
SHA1 26d2120bb2cfa892de9e383bb73cb8b3cd245194
SHA512 fb218732cafa170efa0df1e0a14890e343db7df88898e425f795d13079caf7f95a6917c455f835165c61ff609e2ffe059dd528df748a5c96a77b4f4ab65380af
SSDEEP 768:VscaIiID3mbWMABWawquZsezWTjgKZKfgm3EhfJ:Cc1N3mWM8WqezWTUF7EJJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

47774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bde2ba59-239b-ec80-c564-17b1037f442c.zip

mercurial.executor.v1.03.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

bde2ba59-239b-ec80-c564-17b1037f442c.zip

mercurial.executor.v1.03.exe

mscoree

dotnet