mercurialgrabber | 010870f0e625544560333a18d440abdb08dce009224feb371c709e0162b005da

General

Target

RobloV.exe
Size

17.0MB
Sample

240609-vhbtasdd42
MD5

243baa64b50be7d5e1d59a04c34e13fc
SHA1

fc5cf99131422688aceff54d75172eb698c0795d
SHA256

010870f0e625544560333a18d440abdb08dce009224feb371c709e0162b005da
SHA512

7cd2458c68096f998936db86a81a2603cdd7324768b882bd5cdfc31369f978c6d8f02b3aa89b01837c53f08edd7b91c5c27ca9fb062faf649f1c6a3be81879b3
SSDEEP

393216:GEkcqv69JWQsUcR4NzK1+TtIiFYY9Z8D8Ccl6lZCE+PKSauKo:Gkk69YQFS1QtIDa8DZcIlAWSZKo

Score

10^/10

Malware Config

Targets

- Target
  
  RobloV.exe
- Size
  
  17.0MB
- MD5
  
  243baa64b50be7d5e1d59a04c34e13fc
- SHA1
  
  fc5cf99131422688aceff54d75172eb698c0795d
- SHA256
  
  010870f0e625544560333a18d440abdb08dce009224feb371c709e0162b005da
- SHA512
  
  7cd2458c68096f998936db86a81a2603cdd7324768b882bd5cdfc31369f978c6d8f02b3aa89b01837c53f08edd7b91c5c27ca9fb062faf649f1c6a3be81879b3
- SSDEEP
  
  393216:GEkcqv69JWQsUcR4NzK1+TtIiFYY9Z8D8Ccl6lZCE+PKSauKo:Gkk69YQFS1QtIDa8DZcIlAWSZKo
Score

10^/10

mercurialgrabber agilenet evasion execution persistence spyware stealer
- Mercurial Grabber Stealer
  Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
  stealer mercurialgrabber
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Looks for VirtualBox Guest Additions in registry
  evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Creates new service(s)
  persistence execution
- Looks for VMWare Tools registry key
  evasion
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2