Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    GorillaUnbanner.exe

  • Size

    42KB

  • Sample

    250218-aeh3zsvmbx

  • MD5

    2f0e33a107758d9752b5d8caafefda2a

  • SHA1

    1cdd6766b17aad972cedd7e448f9704161709d08

  • SHA256

    8ce381455c6cc7f68574f0e258e4aaa7a8856e439b9650bf2b110e922a73d791

  • SHA512

    9f55614d1ce6296ad9212eece2ed5a64710a8566be8e660c830f554c567ebb28f9a0c0c345542fefda71bd7279a02bcec170f7d229893defde4485edfe2b59ea

  • SSDEEP

    768:vFFGAUvRHCTuZSLRVTj75KZKfgm3EhYh:WRHCPLRVT35F7EOh

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1341192836023848981/MHmt34PTZZ_P_jTTneScbh_QIw9mlThCTekNBxgsaOnuwkBHwRizs2_F6x5ofxMBehpH

Targets

    • Target

      GorillaUnbanner.exe

    • Size

      42KB

    • MD5

      2f0e33a107758d9752b5d8caafefda2a

    • SHA1

      1cdd6766b17aad972cedd7e448f9704161709d08

    • SHA256

      8ce381455c6cc7f68574f0e258e4aaa7a8856e439b9650bf2b110e922a73d791

    • SHA512

      9f55614d1ce6296ad9212eece2ed5a64710a8566be8e660c830f554c567ebb28f9a0c0c345542fefda71bd7279a02bcec170f7d229893defde4485edfe2b59ea

    • SSDEEP

      768:vFFGAUvRHCTuZSLRVTj75KZKfgm3EhYh:WRHCPLRVT35F7EOh

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Mercurialgrabber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks