Extracted

• • Target

    FKjdctVS.exe

  • Size

    42KB

  • MD5

    e7871defe3ff71566b3600eea0f61eb4

  • SHA1

    44692b1477d43c48987daa0a34314b770505ebbf

  • SHA256

    b6c68a183d0a85c967cf0e20082da608c7febca84fb66b1c085bef83c4d76894

  • SHA512

    6a560fa39c23ea83a2049209f0e53935c321395755cc86b25ea25b29ff1315f1a7ee49da2960f9c1b796748195653a86d28506cb3e551d6530cb09d289f0cb27

  • SSDEEP

    768:4cNCbujiewetQDGm8UuZyLxYTjsJKZKfgm3Ehik:XcSQD8ILxYTsF7EQk

  Score

  10^/10

  mercurialgrabberdiscoveryevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1