Extracted

• • Target

    output.exe

  • Size

    41KB

  • MD5

    55e027ed5c7bd86a809aa46ad7c7657a

  • SHA1

    da01b21defa1f45a196e529ea66bdd32415fbeb0

  • SHA256

    f8ac6fb08eadd5ecb4e305ee50f35e5ee6793ea6a3608b0e882b50982f9e02db

  • SHA512

    ba4bd0623c33252eabeaec160f7ab61df61199c68bc140a05fdcc21435958354ca7f0567012e40813ca377978ece3e6b451bb54a74ccb7d8afb85ef0ed46bfa8

  • SSDEEP

    768:1scaIiIqfT6ahzpDXswIuZkepWTj6KZKfgm3EheZ:ic1ofnhz8epWTOF7EcZ

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2