Extracted

• • Target

    1b8fb7ba5b8df9b78b495cd8bf6dcfa9f2c2788ca14db5f0a8c6f764477e8651

  • Size

    302KB

  • MD5

    409eed418408597f0a962a72084954fc

  • SHA1

    138afac3a26afe9ae80c2f4039aa37b683c720a4

  • SHA256

    1b8fb7ba5b8df9b78b495cd8bf6dcfa9f2c2788ca14db5f0a8c6f764477e8651

  • SHA512

    483cf76c9c59d024491c68bb8678676060e1b375e4b3264aad4a88ef85bb5a300e4210d56d0a3e7677dbf19d101e72b9fd11c8f9a4a91d04234b8fd023eda8a8

  • SSDEEP

    6144:vRCiEKbuoRwE5WTrKi4LnqYkmIRZr/sBrD/jk9jtqpa7xjLazT:dbuoF5ErKNqKIt/0bk9jt4aFw

  Score

  10^/10

  mercurialgrabberevasionspywarestealercredential_access

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2