Extracted

• • Target

    39c39551d8e303c5cfeae5a5578caca8

  • Size

    41KB

  • MD5

    39c39551d8e303c5cfeae5a5578caca8

  • SHA1

    310e4068365562cca6c1d4c977646dd8bee5a6ce

  • SHA256

    a02c98421b1b97d3a1d71265382a568174bb9d7102d403e7ea8d30f410f10995

  • SHA512

    558e1ad709cd9ece53111c9bef2d562a9202f1858930e23c10ebb53d74682f3cd97afa03949ced09b4f740ad6c4085419beff02e1b5ef8b8a6eb9bce18c096e4

  • SSDEEP

    768:1scG4A07Q+SDzcwGuZheIkWTjqKZKfgm3Eh0y:icBQ+iNeIkWTmF7Eay

  Score

  10^/10

  mercurialgrabberevasionstealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2