Extracted

• • Target

    zeo customize by existed/Aiohttps.exe

  • Size

    42KB

  • MD5

    9ecd8b63174404bef96d09438f19141e

  • SHA1

    5bfeb4dddeb4b486c314ecfc039c7bce00001bd4

  • SHA256

    87b1e00f45b839c84d501004e5ad4f44963d1b8ab78e02eff59170c137ea0507

  • SHA512

    d38c63c1440b67e875d7ff690ec1964e10879e24e8f35ee12e44bcac74074de9b60b0d7f4c1044e3e809d97ac39746030ba7856c59ef57509055d6c25b80b374

  • SSDEEP

    768:FqevTetQDGm8juZNLoSTje6KZKfgm3EhUP:wYSQD8SLoST66F7EyP

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2

• • Target

    zeo customize by existed/zeogen.exe

  • Size

    6.6MB

  • MD5

    c6c519e43407eaaaf240077f1e8fa418

  • SHA1

    d5b20223f96619e997ab58d5e98cd10322a2abd3

  • SHA256

    43717d6c756379b64d7f8289e2bcd7a585ced7fcde720db6171a190de648dbd2

  • SHA512

    db7c66076db109c245104b90e82cf9bb2773e9d501501e752bf91fd3b59b03f2d1c33afd1f86f558f2930f4aa80a2a2aa449ea4d4a588bf12b06cd3d2fe870a6

  • SSDEEP

    196608:8T6DSL2Vmd6+D0JJVAzDaku99mEQcy6d/AyfRL6:PSL2Vmd6m0JJVAzDakArZd/Ayf

  Score

  7^/10

  • Loads dropped DLL

  behavioral3behavioral4