Extracted

• • Target

    Discord volume up.exe

  • Size

    44KB

  • MD5

    caf2bee2bab72cba44e7a48ce122a802

  • SHA1

    609a5c723e50f499f05169768fa6a6a595e0e9f5

  • SHA256

    8407cdff15fb5f5fda9319233ed36514319cb9f0beca3ccd070dfeeae941e75f

  • SHA512

    7ecd09fd23e319c1c88accde2263012b72ac59b8a57c54a14d68de0d9590487c23ba03c648107a0e536caa3ca4badfb6083a7923f17571a59985977f4efc2750

  • SSDEEP

    768:xmL9j0QY8YwFZomMvuZKLCkTjhNKZKfgm3Eh+BlN96:QLbLY2R6LCkT7F7EAHN96

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2