Overview

overview

10

Static

static

10

BDevsHwidS...ey.exe

windows7-x64

10

BDevsHwidS...ey.exe

windows10-2004-x64

10

BDevsHwidS...er.exe

windows7-x64

5

BDevsHwidS...er.exe

windows10-2004-x64

7

BDevsHwidS...er.exe

windows7-x64

1

BDevsHwidS...er.exe

windows10-2004-x64

1

BDevsHwidS...er.exe

windows7-x64

1

BDevsHwidS...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BDevsHwidSpoofer.rar

  • Size

    87.8MB

  • MD5

    16d8c15ac98b515fb77fd83e64b39554

  • SHA1

    e64f1e4e57ba98292e433e0e67d48bf50e20a4c0

  • SHA256

    884fb17d58024c96f35e10fe5b81c521032bb6176e91d1ed2b4cfba8f62341bb

  • SHA512

    9c0b630f02eb36678c6b9266c6c18e51dc12938b1139e0f08551baf9db7818f82e709b2c9c25a2bc1de7201ee27b5074fdd4b7333eb33aebea25dd8d723cc4b2

  • SSDEEP

    1572864:Wz9YaNI37Zdc/yFMlhngLFFKWmqAlIlfz9YaNI37Zdc/yFMM:e9YP3FSbgLF8lYr9YP3FSM

Score
10/10
mercurialgrabber

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1342592218795479070/gAprajht67Sa8ORePbAXrGT6sIbifHi5L7oiHuXxWUdAHMtuuCdTAvGCQzuS79w1C7lM

Signatures

  • Mercurialgrabber family
    mercurialgrabber
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • BDevsHwidSpoofer.rar
    .rar
  • BDevsHwidSpoofer/Key.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • BDevsHwidSpoofer/ScoFucker.exe
    .exe windows:6 windows x64 arch:x64

    610a565ad5d3e1994fa64d41b0aaf9c9


    Headers

    Imports

    Sections

  • BDevsHwidSpoofer/Updater.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • BDevsHwidSpoofer/data/Updater.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Sections

  • BDevsHwidSpoofer/data/loader/data1.bin
  • BDevsHwidSpoofer/data/loader/data2.bin