Extracted

• • Target

    c6f1a011b83959fb953436fde64e4ff1

  • Size

    94KB

  • MD5

    c6f1a011b83959fb953436fde64e4ff1

  • SHA1

    8c864de8572c93975e3fec6be69c0adbefe1f1a9

  • SHA256

    1227ca6fb3662e062c4246a7fab2ddc137c275343450bd41273970a646451142

  • SHA512

    03268fa5ff46943cafc91c77baa8ea45517ab69d2dcf31853dfdd4543696a980481bf428bc81483a4827a335ab055f8e99ec87c22fede2bba35f6a53b201b359

  • SSDEEP

    1536:XcapFQjXeXWTqF7E5Bz2BeP/+c5p5c+lXSoaLfmT8rXwWdc5fwY:sa0eGTqF7E/z2BePz54+4ocfmIrgW2dP

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2