Extracted

• • Target
    working key/working key/working key.exe
  • Size 42KB
  • SHA256 ad2dc3e2cf9bbcff6fca8645731850e33d9f5dd19a2e864aa611c7e5cf50639b
  • MD5 ff14bb3b31fee2eab5895bf147692528
  • SHA1 2ee91155e0d48944c7bfc2345b0989d321d3b51e
  • SHA512 ba5daf2fb2de19bbc2b0f038d32e720297e7b3ccd3ddea30b023ea77bec97705e949c0590d8568865e27001e7be27c9d2cd8bdc42aa4e1029bac36fd4a6f2d14
  • SSDEEP 768:iuA5Ehi4//4MbuZAuL5vTjtKZKfgm3EhgZ:wE0aDsL5vTJF7EeZ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1