Extracted

• • Target

    BDevsHwidSpoofer.rar

  • Size

    87.8MB

  • MD5

    16d8c15ac98b515fb77fd83e64b39554

  • SHA1

    e64f1e4e57ba98292e433e0e67d48bf50e20a4c0

  • SHA256

    884fb17d58024c96f35e10fe5b81c521032bb6176e91d1ed2b4cfba8f62341bb

  • SHA512

    9c0b630f02eb36678c6b9266c6c18e51dc12938b1139e0f08551baf9db7818f82e709b2c9c25a2bc1de7201ee27b5074fdd4b7333eb33aebea25dd8d723cc4b2

  • SSDEEP

    1572864:Wz9YaNI37Zdc/yFMlhngLFFKWmqAlIlfz9YaNI37Zdc/yFMM:e9YP3FSbgLF8lYr9YP3FSM

  Score

  10^/10

  mercurialgrabberstealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1