Extracted

• • Target

    GrimLoader.exe

  • Size

    42KB

  • MD5

    735eb25f877a4980b0b76c2f065d4a70

  • SHA1

    4a8b6aed9b6a1f849d5ad34a2c362afbfbc74005

  • SHA256

    135fdc6be56667ccda9e1171eaee2adb19d13e2ec18768b9ecc029c29ed17ad9

  • SHA512

    0c50c594be3552ab274d1750a097f0439678190d4cb5eb890e86bde1a8c018a71ff13ea86daaf9aa84dff600b552ce015040e4aa6b9543b0fbc213b6c8c04c90

  • SSDEEP

    768:MmtZ5E9E//4MluZNLL9Tj+EKZKfgm3Ehkz:ZEIDkLL9TKEF7E2z

  Score

  10^/10

  mercurialgrabberdefense_evasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1