Extracted

• • Target

    d.exe

  • Size

    30.1MB

  • MD5

    d28d1fb7e5f6e18fdf38056fedc4bcc7

  • SHA1

    cb1d4b3e4e07c24946a49e8f67a1a5f37d945d90

  • SHA256

    03401dc5183cfa15c4456d97e9bb8b6198582f8c878f0c1c7915087e5f589e12

  • SHA512

    12b551ff8ff52ae423abec99bad8b7ad0d72ae87e442d133185c42268fe6d7ea557d60e56ada72c77253b7a15de92c2b4f631dfbe1186ae91370da896c9b7973

  • SSDEEP

    393216:RQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgF96l+ZArYsFRlW:R3on1HvSzxAMNFFZArYsu

  Score

  10^/10

  mercurialgrabberdefense_evasiondiscoveryexecutionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2