Extracted

• • Target

    4a634557e9b69e708df362bce68ee98e.jpg

  • Size

    50KB

  • MD5

    7fed0c8060ae713c444e331aa955d004

  • SHA1

    dcf6b060f13edd9ab647a7b09beb022826783591

  • SHA256

    7568bbb9cf49b4b956ba3907f8d3597e97e9db1f32a8208a609fdcba9e9df88c

  • SHA512

    75b17ab0f33c50b2f2b91fe34e834e292d051f59fae281087cbd04cb8e222ae12d28838c89b897cd332e08f0904706c67195e4917b214486e29bfe22629a43fc

  • SSDEEP

    768:Pzozq4t1ciVGwxo2ZDV477TPMiG0HD+8Luo4IUdSnFVbz1jTzyMXy2u2IXZ:Pzp4XciVGwu2inMiRjJ3z7bzZmMqTp

  Score

  10^/10

  mercurialgrabberevasionstealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1