Extracted

• • Target

    RobloxGameGrabber.exe

  • Size

    41KB

  • MD5

    9036134c2be4ab6b93490feaf419d4bf

  • SHA1

    9e4157ed13486a5af5e5691a6e4ffc8f26c7d41b

  • SHA256

    9611ea81bb2bda5a577acd871994640ed4bcd18aff6ddeac7e04ac1fa03b0745

  • SHA512

    b5c43a17018746a99aecbdadd9be913bd2cc5aeecc197f62174d8a6d2a145c2b9e6490e744100eb0f2694210ea400e52bb81234d575cd04fbd0af0d2746641d2

  • SSDEEP

    768:WscaIyIS+7YxGPvSPYwXuZEexWTjRKZKfgm3EhCi:1c1VYZPlexWTVF7EUi

  Score

  10^/10

  mercurialgrabberdefense_evasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1