Extracted

• • Target

    Back-Soyer.exe

  • Size

    28.5MB

  • MD5

    9d3d31bff67dd9d59dfa29a20b5f7519

  • SHA1

    26ff73ff1fcb676e3bdba0ab521cb780f7933ecb

  • SHA256

    726d381ab9f30dbf5aa49cb4fe805d580e3547683617f5ef985500eeb7340ae9

  • SHA512

    414004a9eeb3516b0e17ececb7fc1dc8dc521eb2d1fada915cea929a0fe7c0075a40482444b5076cf2b657aab76dc7c5da9b290fe54b39682a614cac9c13be63

  • SSDEEP

    786432:49ef7yJbTiumfSM2ocESWqEIBBOqWEXjQA:awmxTivfSIfqrBBmEzQA

  Score

  10^/10

  mercurialgrabbercredential_accessevasionspywarestealerupx

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1