Extracted

• • Target
    7a4dc2a8a41a6c39fd9acb97049139e5
  • Size 204KB
  • SHA256 cb9bb79eff442ff90346150fcfcf1d76cb4dbac80e9e1464fd0775d525f3c47f
  • MD5 7a4dc2a8a41a6c39fd9acb97049139e5
  • SHA1 83d8d35d1f447578bafc36699244ea2c842bba14
  • SHA512 76d979df1d58ca7a46e12b4b14a376ca65358220b0151aa99c0ff6a795735a5fae93206a2fef4194354447f51e096a9b2d8e01fe2162b4e70278a77bf2363d1c
  • SSDEEP 768:zWgpfEUK4Y8Y9UomM8uZ1L650TjtKZKfgm3EhO737jK0oabFV9R+XJHO:9fFLYSWL650TZF7EY73nK0xrPgpO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2