Extracted

• • Target

    fef2d719561bfa330d7aa2ea23effa6a_JaffaCakes118

  • Size

    41KB

  • MD5

    fef2d719561bfa330d7aa2ea23effa6a

  • SHA1

    4798e3e00865efb7941bb95fd87da43528e5af36

  • SHA256

    a61de72fe9e8d4c77fa8e91193e7ab59e6d3b57e54f6d144a4b99eeee9a034b9

  • SHA512

    fe811a4f3203ce49d126a5b5c08aab47b6311b4ed80b4416a7bf6b466f68d96c8af4127c59188288245a4412a865832b5be36f64f80326e7f6b1bef384e15918

  • SSDEEP

    768:CscGoA+MKl9cw9uZleZWTjjKZKfgm3Eh5G:RcvMKlseZWTnF7ETG

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2