Extracted

• • Target

    idtoip.exe

  • Size

    42KB

  • MD5

    6c9e0a5d15c0241a6c251c1c0551dc2b

  • SHA1

    6266f959050757346485a255a1a519b62909a06e

  • SHA256

    60445c9764e847e363510f3e712ba3dec585cc1c3aaae2e768ea91f90f1167e5

  • SHA512

    b148b42131df21274afed1f94e7b52ce598d20043764fcf30efa8bc263a6fa35fb9bb4eee3aac72466014ab695dfd2098d11df137314ede2fafae0b099daac65

  • SSDEEP

    768:RrK3XLHuke/uZX/LUoTjlKZKfgm3Eh2E:RrAHreC/LUoTBF7E8E

  Score

  10^/10

  mercurialgrabberdefense_evasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2