Extracted

• • Target

    Ultimate Discord Nuke.exe

  • Size

    41KB

  • MD5

    f92a24b9bd5fac729a1921f814d63fe7

  • SHA1

    8ef5e68c274d2b98ae0c4206e6b230b96f2177f0

  • SHA256

    034a1a036a79c43d3b03e5346fd62c66e2fd73f6966216cef4b008633052df43

  • SHA512

    3b3b21861be0d45298994b843ab7c08571d71a6f271b38329ab0b36810b78cc1a668e530d51a72cf6a788f0b77b4aea6889c0db23712d1eded2f43c5299e3790

  • SSDEEP

    768:+scG4AKGgSbYKehXmRGwSvuZVeCWTjWKZKfgm3EhJB:NcfGgScKQmRUUeCWT6F7EvB

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2