General
- Target MercurySetup.exe
- Size 175KB
- Sample260916-rqendaws7q
- SHA256 162439d53564a418daf81dc7bbb4630c798d0bc7f6b110ef2fbffc582f5a10bc
- MD5 bc7a13c41b60b3891ff5630c6b270e46
- SHA1 3598bc40c8f5edaa2b9ef324b6336b5a9d5904eb
- SHA512 117129bd615d51e61709fff7c009c63922bb145e48dbfd9dbcacef856bb79b0e6bcf2769b1200752ceeca835255f7e60a96da9c7cfa41e48866d820601922edf
- SSDEEP 3072:lqeXA/4yIg9vkNPNu6H6xCYOihUE265WJI19j34yNE:lvgvkNFNaxmpE2J034yi
- TLSH T193043B07A2A851BEE1B7C679CDA24941FB73781A8B71A7CF175049B60E737D09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MercurySetup.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
MercurySetup.exe
Resource
win11ltsc2024-20260911-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target MercurySetup.exe
- Size 175KB
- SHA256 162439d53564a418daf81dc7bbb4630c798d0bc7f6b110ef2fbffc582f5a10bc
- MD5 bc7a13c41b60b3891ff5630c6b270e46
- SHA1 3598bc40c8f5edaa2b9ef324b6336b5a9d5904eb
- SHA512 117129bd615d51e61709fff7c009c63922bb145e48dbfd9dbcacef856bb79b0e6bcf2769b1200752ceeca835255f7e60a96da9c7cfa41e48866d820601922edf
- SSDEEP 3072:lqeXA/4yIg9vkNPNu6H6xCYOihUE265WJI19j34yNE:lvgvkNFNaxmpE2J034yi
- TLSH T193043B07A2A851BEE1B7C679CDA24941FB73781A8B71A7CF175049B60E737D09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger