Behavioral task
behavioral1
Sample
CSGO_Rebound.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
CSGO_Rebound.exe
Resource
win10v2004-20240802-en
General
-
Target
CSGO_Rebound.exe
-
Size
41KB
-
MD5
38f74fe64c455198c43d478400b202af
-
SHA1
a82b7a81ce5aa1d6d12ccef6a927de9473e94898
-
SHA256
d163fe9b92b1f6f44ec58bc05bcbc919f78f9e343d9691f0bb1b8162d3d0087c
-
SHA512
2376716f957d2dfa56b63bd484ed90f82815064969a2c8cb0074bde931e467e99fd6f96f71732c194c24350e670d83aaafd317b6afe64e59af057bd89f20ec4d
-
SSDEEP
768:PscaIyIq3PJOJTwf4uZSceKWTj5KZKfgm3Eh0T:kc16PQAoceKWT9F7E+T
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1287576977489920101/qn6q-HR5nSw72La9tctjugcKDnTYkEdiUMCxvbCQZK9FPD7CNhkDCwvlhZUWz9oa6ach
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CSGO_Rebound.exe
Files
-
CSGO_Rebound.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ