Extracted

• • Target
    82e3736d3e11dc5d287cfb45e6e8c1bf
  • Size 1.2MB
  • SHA256 7e73773f2785742408d786941e12203289ccb8ef0b5e819a101992d2d85c2ae9
  • MD5 82e3736d3e11dc5d287cfb45e6e8c1bf
  • SHA1 ca4da629d6a8d79f2e67cabdb3a6031829cda254
  • SHA512 72e6c30cd9ea54e9e77ef606fe190a7584b2812eb650a2b6ff54b7cb257210590d00daae10c7d1a2a587e7570d839dface0e40dd4c7d27e64c99c296ef5bc4e6
  • SSDEEP 24576:SR+cl7X1BRnI6hmebOe1UlqV4Ze2NFbVgAgDFOFwgkQW/XzsnNg:W+clb1BRntmeSKUAVEXNFbVgTlgkpmNg
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2