Behavioral task
behavioral1
Sample
bea2a9767a931a547ad3d32913c752b613117c6868728a2fd81a5ef268f05116.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
bea2a9767a931a547ad3d32913c752b613117c6868728a2fd81a5ef268f05116.exe
Resource
win10v2004-20241007-en
General
-
Target
bea2a9767a931a547ad3d32913c752b613117c6868728a2fd81a5ef268f05116.exe
-
Size
42KB
-
MD5
7f4d45a0994b619ede5fc5a28357cf81
-
SHA1
32c5782421a65f06b84715f24e93a6e60136c537
-
SHA256
bea2a9767a931a547ad3d32913c752b613117c6868728a2fd81a5ef268f05116
-
SHA512
abc02b2d6fadfe64804f175b4358dd251d94c279af7b3991e37f7535ddd66148d31702e1b27dc05d0e65ba9f30156085c1bea5d1b7528a10d001966393aca272
-
SSDEEP
768:ZPSm4lMmcgmpxuZsLRqTjAKZKfgm3Eh1AH:5AWpvLRqT0F7E/AH
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1324237031412600885/jXaIg4ATTpSFG8ZigAQLqZW3xZHhnYwtWWXOJOJ8ax3avDT0yUes6EI7UXDkcRKIQn7r
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bea2a9767a931a547ad3d32913c752b613117c6868728a2fd81a5ef268f05116.exe
Files
-
bea2a9767a931a547ad3d32913c752b613117c6868728a2fd81a5ef268f05116.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ