Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Injector.exe

  • Size

    41KB

  • Sample

    250205-pnxeaswmey

  • MD5

    0b6d06e0f0761bd1291844b534273882

  • SHA1

    8263fe810b0c97847ea8b0ea79f66db6b7c364e1

  • SHA256

    9b5fb049145e86e6bc591c838fc61acc8771422fd0f7845334ded6651c046f78

  • SHA512

    5059c8049cf298e1aae47744807abcc2ad0580dc228d55016075e3bef5f9b99bea25dd7bb36cfcebfe09928ca7326572d6cf557e8f99f0f1c6781f9fc0a0f0e2

  • SSDEEP

    768:NbscaIyI97QtocwZuZ7euWTjPKZKfgm3EhFu:NAc1zQtVeuWTTF7ELu

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1336674648091394129/hQv33Zirc_XbYUaWXd0YWsHsTsYlKbJb7os3f8W1bI8wjmMGi271Ij3PS-SLIDzQQMbd

Targets

    • Target

      Injector.exe

    • Size

      41KB

    • MD5

      0b6d06e0f0761bd1291844b534273882

    • SHA1

      8263fe810b0c97847ea8b0ea79f66db6b7c364e1

    • SHA256

      9b5fb049145e86e6bc591c838fc61acc8771422fd0f7845334ded6651c046f78

    • SHA512

      5059c8049cf298e1aae47744807abcc2ad0580dc228d55016075e3bef5f9b99bea25dd7bb36cfcebfe09928ca7326572d6cf557e8f99f0f1c6781f9fc0a0f0e2

    • SSDEEP

      768:NbscaIyI97QtocwZuZ7euWTjPKZKfgm3EhFu:NAc1zQtVeuWTTF7ELu

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Mercurialgrabber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks