Extracted

• • Target

    Z_lookup_phone_number_5685021465.apk

  • Size

    22.5MB

  • MD5

    18f6a38db19b858d1a044cf08e62216d

  • SHA1

    c09208f06c8d484072b1e1b4601f85608019b3fe

  • SHA256

    701f93961976def77d541a81eed72fd053b862477c64dde1c09a43d85733d85c

  • SHA512

    77953f45971ce41e3fd389882e14c59250723c0ab7e5eadbf104d42870e11023400177a281878e20e4ec5a2a30b15b71972f5ff8339ace4efbdde9a3af2e4006

  • SSDEEP

    196608:GPIKImxXLJfgG00Lv/t2CrsclY1Sn1GXrAoXZIL6AzsrolgJqp8B1sPU:FKrAG00Ln1dmYWizYroYqp8B1sc

  Score

  10^/10

  mercurialgrabbercredential_accessdefense_evasiondiscoveryevasionstealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1