Behavioral task
behavioral1
Sample
bootstrapper v1.19..exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bootstrapper v1.19..exe
Resource
win10v2004-20240802-en
General
-
Target
bootstrapperv1.19.rar
-
Size
17KB
-
MD5
e228a8eeb62a5eb27f72ee19b821c706
-
SHA1
f420dc51fb9e57b129c60c0eef80fc3690cdd177
-
SHA256
5864f78572cb77005fa146aec87f5c3e119827a63f69f7d500a6e7099a532a53
-
SHA512
d37f36008dcaa858e332bf2016d41df1d822ed35f0579cb9e8da643359c0135b5f625051381b1a72ad263b72863e2dc68e44059d26ba8a2875dcb2ec61887a32
-
SSDEEP
384:60WZNFIT1ajevSU9Sr5OxAN7FfxB7UOpo/auYYHLqEscFViN0DKi+:xWBY1zRcr5OxQpCOMgYrqEdHBDK1
Malware Config
Extracted
mercurialgrabber
https://discordapp.com/api/webhooks/1287494730313367614/ADttPZV4JMT077jKqJ1N8O9urk62UJzmFZVMMTu_q-b-4ZuAjiwG2hAFrvkr4NyoNiSO
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bootstrapper v1.19..exe
Files
-
bootstrapperv1.19.rar.rar
-
bootstrapper v1.19..exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ