Extracted

• • Target

    balslacke.exe

  • Size

    41KB

  • MD5

    4ed542cf60b10e710aa5adb9793b6bfd

  • SHA1

    cdf8b4fb9a09fd7a1f80378a7d017f54ea0a3e5f

  • SHA256

    91c6f2cb0bb3f42b7f29a6c0506b5f87cbdd6e26d94c10025708763ac878aeb4

  • SHA512

    e91807529f75be869683137c8a67d031eb3400672799297c11b803b087416c93851e097cea10bd49ec30cbee1d7f04cda5432b789d615c92474f11aa1a852ed4

  • SSDEEP

    768:NscaIyIqaTQSwEwuZVeeWTjeKZKfgm3EhYI:qc17HeeWTqF7EGI

  Score

  10^/10

  mercurialgrabberevasionspywarestealercredential_access

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2