Extracted

• • Target

    d41eebef8dcc0c21529bedf93c6b1287_JaffaCakes118

  • Size

    3.2MB

  • MD5

    d41eebef8dcc0c21529bedf93c6b1287

  • SHA1

    dd314781d2656e47643d28861428ac3af2a0bf03

  • SHA256

    6a5828ebe60437b32192ea3a81ea04e90f24dc9b352b1680781cc22c742ff946

  • SHA512

    a0c022800cc24407c5700f0e5660491a1d6a7f0524e7db78bcadb3a1d8b8eeebd5074a75dc2fbc20df2068c4ccd7565dc18379bf6383c8204e6240c5bc112466

  • SSDEEP

    49152:anrhr/vAcWKv6X3o0GQN0s/g/ybPUt81yyxYHm9m9h2nrhr/vAcWKv6X3o0GQN0G:an/WG6H/THYHmucn/WG6H/x

  Score

  10^/10

  mercurialgrabberdiscoveryevasionexecutionpersistencespywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2