Extracted

• • Target

    Image Logger V2.exe

  • Size

    41KB

  • MD5

    e1d9a9e7ff84fa7ee690dacc4ea18cdb

  • SHA1

    c6bca7690d964e279ef0261e424bfefbdb342208

  • SHA256

    890eb759f46a42e6b2a9cc5740eb19ea37589a046b0e9e32c0ad0fdcf23c76c4

  • SHA512

    ec4c2adafedd13fae600b5c51ebb2bdeb09f685b2dea21a27dcd50016faba2b75265ca77411c581eac5b781ada9c6c735da4fa37caa9b37d84a939e3d0520dba

  • SSDEEP

    768:MscG4A6bYc+TSwIuZKeRWTjqKZKfgm3Ehsw:Dcl2TieRWT2F7EWw

  Score

  10^/10

  mercurialgrabberdiscoveryevasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1