Extracted

• • Target

    working key/working key/working key.exe

  • Size

    42KB

  • MD5

    ff14bb3b31fee2eab5895bf147692528

  • SHA1

    2ee91155e0d48944c7bfc2345b0989d321d3b51e

  • SHA256

    ad2dc3e2cf9bbcff6fca8645731850e33d9f5dd19a2e864aa611c7e5cf50639b

  • SHA512

    ba5daf2fb2de19bbc2b0f038d32e720297e7b3ccd3ddea30b023ea77bec97705e949c0590d8568865e27001e7be27c9d2cd8bdc42aa4e1029bac36fd4a6f2d14

  • SSDEEP

    768:iuA5Ehi4//4MbuZAuL5vTjtKZKfgm3EhgZ:wE0aDsL5vTJF7EeZ

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1