Extracted

• • Target

    Exodus.exe

  • Size

    42KB

  • MD5

    865e8e8e7ba1a140fc8c771e328ff9a7

  • SHA1

    c900d82aad37e5f70f367216dc4cf8c8a039221c

  • SHA256

    57045a88eb427b584350171792e348d1daedd7970b3e46ac8b3c9e035c2208ca

  • SHA512

    89902b3aa63d7bbf8431fd92a9bbf2595089c8405d20e3f75157fbe7edefb7b4272fbee7061c0ca29e87fd2a6ff56717932ba1fc90d151410fa4f62bdf83c72f

  • SSDEEP

    768:XYgu8ZBZ6aZpDts3uZHLVgXTjKKZKfgm3Eh1k:XuQ1ZPsULVgXTeF7Ejk

  Score

  10^/10

  mercurialgrabberdiscoveryevasionstealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1