Resubmissions

07-12-2024 01:36

241207-b1cc1aymdx 10

General

  • Target

    output.exe

  • Size

    42KB

  • Sample

    241207-b1cc1aymdx

  • MD5

    6df2f04b617beb9cd0454f528fa5dba9

  • SHA1

    85dbecd06ccfcc52a701cb541a21e5fe56932d7f

  • SHA256

    2815e46ccd7635b296686fc9a9b3691998cd9a274fe2a7a94c61c6699d9a5c50

  • SHA512

    5e2dc191773ed78a0c55d133a9c8fd056970b252d55a4f8c9c80df57447f67423e68db9bf4cc12087818231f4fb9effdbe58923c03ef58616c191fdb6f7ba672

  • SSDEEP

    768:cLIBZ6aWPpDtsmuZ2L65TjlKZKfgm3EhYJ:j1WPPsOL65ThF7EuJ

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1314767049267875882/NJaVPRXpYcNaXw4sYAd4msJ1JNHj6CEOspxK1vQ1Tfi33pJwKx_KRpnxTaxOkBxp5v3W

Targets

    • Target

      output.exe

    • Size

      42KB

    • MD5

      6df2f04b617beb9cd0454f528fa5dba9

    • SHA1

      85dbecd06ccfcc52a701cb541a21e5fe56932d7f

    • SHA256

      2815e46ccd7635b296686fc9a9b3691998cd9a274fe2a7a94c61c6699d9a5c50

    • SHA512

      5e2dc191773ed78a0c55d133a9c8fd056970b252d55a4f8c9c80df57447f67423e68db9bf4cc12087818231f4fb9effdbe58923c03ef58616c191fdb6f7ba672

    • SSDEEP

      768:cLIBZ6aWPpDtsmuZ2L65TjlKZKfgm3EhYJ:j1WPPsOL65ThF7EuJ

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Mercurialgrabber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks