General

  • Target

    Idk.exe

  • Size

    42KB

  • Sample

    250326-zqwkwssyfy

  • MD5

    e7741c044277fa3f4393a24f448e660a

  • SHA1

    4487b368b2902900f180c73218e504b28e83fd88

  • SHA256

    408d19e52f4bf6ab8faeb03b1a93d08d7293e10e741d1de59e716627a72733b1

  • SHA512

    45e77b4ae7355d843b9cf73a408e97d3cd7589372ceefa837580c29a8c545e7f9378740163a1f145f717aa19600d3142ccf16335ba4911062e11c0f6f88e89a8

  • SSDEEP

    768:ZqFK330/XSN1uZNLRPTjFKZKfgm3Eh12:AFi2LRPThF7EP2

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1354559012762419201/AotG8pZ98gkWzZZIX4L-2HwFSt0dJ9rzFV3ZyhStumXho43elLmsGAcsrN1zS6tMTvc5

Targets

    • Target

      Idk.exe

    • Size

      42KB

    • MD5

      e7741c044277fa3f4393a24f448e660a

    • SHA1

      4487b368b2902900f180c73218e504b28e83fd88

    • SHA256

      408d19e52f4bf6ab8faeb03b1a93d08d7293e10e741d1de59e716627a72733b1

    • SHA512

      45e77b4ae7355d843b9cf73a408e97d3cd7589372ceefa837580c29a8c545e7f9378740163a1f145f717aa19600d3142ccf16335ba4911062e11c0f6f88e89a8

    • SSDEEP

      768:ZqFK330/XSN1uZNLRPTjFKZKfgm3Eh12:AFi2LRPThF7EP2

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    • Mercurialgrabber family

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks