Extracted

• • Target

    G3tTr0l1ed.exe

  • Size

    42KB

  • MD5

    7845d9b1597af943b084f869ef52fac3

  • SHA1

    055259b6ca9d91734a0ebbfc574f3686386815a7

  • SHA256

    89a60ad154c81cc9a364fece0eed420720cfdd5bf1f8127c768b7af6f66d94bf

  • SHA512

    9ca514034f5eee1570b9a3fde3a81802d366a7e6b691249b4c156fc7f1f9b6612c140265b746284c98d92c4eaf69944ce90901ecb855b527505d93cdce82c272

  • SSDEEP

    768:FcNCbujieQ5EMf4LB//4MvuZ7LerTj8KZKfgm3Eh3Z:26E04L9DULerToF7E5Z

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2

• • Target

    g3ttroll1ed.exe

  • Size

    4.5MB

  • MD5

    33241a3aadf06404014353cfe3a47bac

  • SHA1

    a0bcbb2e7fde364d8f997b95303cd0c3b2e6b9fb

  • SHA256

    05e06e0f9ea0b245aff5f7aadeb69cce15e162effd29b4eec21bac3418ed414b

  • SHA512

    38e72ba8a3876b6d02606183ef671a566a1ce17f4d4923a4ca8a785b60b7240a0c7e29622dea05d3df176ef316a2712a59eba11d37234b4c34aab64dc98c773d

  • SSDEEP

    98304:/Qf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:OzUcwti7TQlF3ZxxWJSUnDv

  Score

  9^/10

  spywarestealerupx

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4