General
-
Target
PyGrabber.BETA.rar
-
Size
20KB
-
Sample
240619-sqhwgasepd
-
MD5
5a1cec2179fcc1a5d8abe6dd854f024f
-
SHA1
fcddfca666c9c109b3e6441f526fdbe9d1308950
-
SHA256
060eeba1a6af6ae88083fd6b7756b7e5892e89e94dd0317757649584386b1b2d
-
SHA512
e92a7941052bd83ee9d7689d643e78a6857e735f05ce449a9faad858b6076f69ca3387472c452455ea2b2c10c4ec720a713433d05677e5f07dd9809e79704a13
-
SSDEEP
384:4bL4cnRhYxtBeVL9hDrnMD9oeATHi88nPzuZZRR/Slv8Gz4nT7aFdH4zQM:qM18VfDbvF8PzubRR/36467fM
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/989605498150092830/I3sJcFFWbTWwsAi6ly8l_n-AJ0DbeIeGdUt5rJnglsUWr5gsPaHLpVae-SL6M8scYn3s
Targets
-
-
Target
PyGrabber BETA/PyGrabber.exe
-
Size
46KB
-
MD5
9934be2fca82f5d2c76e23816e289e78
-
SHA1
4d857ca16570c1e9563f989bc00eba57a1f570e9
-
SHA256
d7431f4441abc86098bee0b76bd07dd6a59d313845d88d246f66de6d2cbc16cb
-
SHA512
995c58845dbd22f986a72573313896b9d8b2f7e5732da301d6310393753d3e4362373860a12f0084f3eb239435c454f99b1ee219c0e79cf7935364e28477b882
-
SSDEEP
768:EDf1uZdxCGO1rtQ7YBCuZ1L1+TjXtKZKfgm3Ehq6lnkN0Wkrh:Yaxm1r1BpL1+TztF7Ek6lnxW
Score10/10-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
-
-
Target
PyGrabber BETA/Setup.bat
-
Size
131B
-
MD5
a58f7bad0e4d3a313ab83847931db227
-
SHA1
ff030845d85b500fbdfaf5f92e528d6bccd8f211
-
SHA256
8099f032726197ae774813b3bb0305ce06a62aa638e4555350400b500377670e
-
SHA512
f48315c0384c2e86fea7a671c422b1b58a73d995e9d451b5e37f73219dc0971a24c30d08cb919c93f97f65a721ee7dd61e91b4ccbc572aad383742f36cada456
Score10/10-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
-
-
Target
PyGrabber BETA/req.py
-
Size
115B
-
MD5
d65f3265f58b43f79c64fb1295858635
-
SHA1
bb7be8136880ccda3bb53d4450d1edc00ba3fa4e
-
SHA256
b32f211cd683158bf7f7cdefc3c7de32fcc61362ae90526898837a1b90eb361c
-
SHA512
3375d2e0ad83496d155afeca2f9d22b8eba9207c0dd2a1c8095a7ef01b48d8c1a03cdd59cb8e3a4131361b6a565d54df6b13ca4309afba4bfa3306cfe1cb383d
Score3/10 -