General

  • Target

    GorillaUnbanner.exe

  • Size

    42KB

  • Sample

    250218-agmtysvmel

  • MD5

    2f0e33a107758d9752b5d8caafefda2a

  • SHA1

    1cdd6766b17aad972cedd7e448f9704161709d08

  • SHA256

    8ce381455c6cc7f68574f0e258e4aaa7a8856e439b9650bf2b110e922a73d791

  • SHA512

    9f55614d1ce6296ad9212eece2ed5a64710a8566be8e660c830f554c567ebb28f9a0c0c345542fefda71bd7279a02bcec170f7d229893defde4485edfe2b59ea

  • SSDEEP

    768:vFFGAUvRHCTuZSLRVTj75KZKfgm3EhYh:WRHCPLRVT35F7EOh

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1341192836023848981/MHmt34PTZZ_P_jTTneScbh_QIw9mlThCTekNBxgsaOnuwkBHwRizs2_F6x5ofxMBehpH

Targets

    • Target

      GorillaUnbanner.exe

    • Size

      42KB

    • MD5

      2f0e33a107758d9752b5d8caafefda2a

    • SHA1

      1cdd6766b17aad972cedd7e448f9704161709d08

    • SHA256

      8ce381455c6cc7f68574f0e258e4aaa7a8856e439b9650bf2b110e922a73d791

    • SHA512

      9f55614d1ce6296ad9212eece2ed5a64710a8566be8e660c830f554c567ebb28f9a0c0c345542fefda71bd7279a02bcec170f7d229893defde4485edfe2b59ea

    • SSDEEP

      768:vFFGAUvRHCTuZSLRVTj75KZKfgm3EhYh:WRHCPLRVT35F7EOh

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Mercurialgrabber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.