Extracted

• • Target

    solara.exe

  • Size

    41KB

  • MD5

    15a9c1e88def62ed4698653817dd49f3

  • SHA1

    4dcd814644624487523e4d9f05cfa7b44cc6a003

  • SHA256

    2442056a304a0c3f67a04a64a51e15b49cc056553f2b46efc74d412da334b8fa

  • SHA512

    e243b9ff72783dbbddaf699a5099afa5bfe9d99260845e825e1742e9a4405a123ca278b71cc365b865daa0915d9bde2b46c7b9440feb325ea6d94f8b2c8f70e3

  • SSDEEP

    768:jscaIiIqfT6ahzpDXswIuZkeMWTjNKZKfgm3EhkZ:4c1ofnhz8eMWTpF7EKZ

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2