Extracted

• • Target
    933e7dceae05b2dafeaf9ff2899161c8
  • Size 41KB
  • SHA256 1937eb167c0aa8b8e31e93b5858efb68301fb42b20fdd6c5bfc407b187d97289
  • MD5 933e7dceae05b2dafeaf9ff2899161c8
  • SHA1 93979c261ad95e6af3d17d8e6d0f6d8b450f3e4b
  • SHA512 3415168eac722f09f693b06b29e4ffcf3638994e2751f723bae9d2c5c312a034206f8ab2f3ac91aa788daf5bcb8153275f0ba5d12ec85bc3d0a0f0a7cee145ae
  • SSDEEP 384:TpKz2TR8U2tSO+dhNn1ftS5rXww4TaXs/XZxIh/4gJEFq5nm0QsaSKQsLd/SfgUq:TgTWr/fMlwlguZ0LNTaSKZKfgm3EhAy
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2