Extracted

• • Target

    Nexus/Nexus Executor.exe

  • Size

    41KB

  • MD5

    a586b36675aec8a5c6ed50e92d388784

  • SHA1

    68aa3dc9f30bfe1106f5d674a7d44b995879aa24

  • SHA256

    3ade02051c85f82194e21864aac14868db1d62e925bf66c0ec3a537637ebdaee

  • SHA512

    b69ac478c26ee6fbbcbdf4b94dd585e9263b51173e8f2f4b8032d7d5421605872a5d3eff3c0fc32fc9e281f0bad9f5471c4ed1543967b1b7935ff14ba57dcba6

  • SSDEEP

    768:3scaIyIB+ntOwEuZge5WTjQKZKfgm3Eh5s:cc1X+Oe5WTkF7Ers

  Score

  10^/10

  mercurialgrabberevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2