Extracted

• • Target
    2e8ec5b8b8e7aa0092dd32564133e6ee
  • Size 3.2MB
  • SHA256 1f1b00c844b5786159fa4f2a59d64da9a6cd4bff6593d3e18a1cb563643e1870
  • MD5 2e8ec5b8b8e7aa0092dd32564133e6ee
  • SHA1 5ec37c62e99c0ea173048cb448d7213d442b43c3
  • SHA512 b20e25de93af0b98ad808e36bbad359d4be256ea82ab2224098911714133fe3329cf1d1b231ff66a22d52a62edcacc004470944e193a13ad9ad27aa253890832
  • SSDEEP 768:0+ivKdxCGO1rtQ7YBNuZWLK85TjjKZKfgm3EhPSChPuJI2l7s+gS9CWdUWtJ:pxm1r1BtLKgT3F7EJzhPuJI2lsGyWtJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2