Extracted

• • Target

    ca25d0141cc9f970b141ac32ba7cf04f

  • Size

    41KB

  • MD5

    ca25d0141cc9f970b141ac32ba7cf04f

  • SHA1

    79e34290aea916240880bcbff5536ebc61797a9c

  • SHA256

    12caeca4b39c98392122d1d498cbd75cc3d61a03cc4cf13667b6820afd054a30

  • SHA512

    f268f2309df3c90877a8a85d999f76edbedfc587a50868a40ea9587f6c8d208eb242963b884aa954a8165f8ef6d696d52b78d030cda962ec67c043e6b0575514

  • SSDEEP

    768:VscG4A1aBYQSwXuZPevWTj7KZKfgm3EhEa:Cc5YevWT/F7E6a

  Score

  10^/10

  mercurialgrabberevasionstealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Legitimate hosting services abused for malware hosting/C2

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2