Extracted

• • Target

    c914a379fec7efc0f846305ad30f95fa

  • Size

    42KB

  • MD5

    c914a379fec7efc0f846305ad30f95fa

  • SHA1

    3b8efaa372936b7eb28e091d8e8a714472a56f7a

  • SHA256

    d06cdd85b68169294b262454c44d8ec6efde0a151c11059f9847fa4096e08094

  • SHA512

    50c89e5f4f2e5cbc1666bb89e922c79ae9e52d9233c5cca4237aef526bf0d16b4d2fea5c3c24006837909561436e964eaaa0e8bff774b46e2803158884d4a36b

  • SSDEEP

    768:tOE7I14lMmDkmpSuZbLnJTjbKZKfgm3EhMu:Y1ALpXLnJTfF7E6u

  Score

  10^/10

  mercurialgrabberevasionstealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2