Extracted

• • Target

    final.slim.exe

  • Size

    5.3MB

  • MD5

    81ec3629d40d7edec8772f4d359fa74c

  • SHA1

    9714c5e0feb98bb8ee1e6e52d51460c4f2dcbe9c

  • SHA256

    23f6a4e7ce6a59f009b688268b6a283323aa10bdc6955d3047c2247a61bc8099

  • SHA512

    5ab1af8a5a51337a6c06210b26312cc15d9b7d634c5e87b56eafca2dec244da0125f079aefd6219bc02e47e61ac4e9d2f1a2c5af5c729b4b35fe6b44e3ea9513

  • SSDEEP

    98304:Srl5kwHbL1vT6x5R14vx+Gjwfg14TBwOJdyajNn077PWJ2Tdta0C7lgODAKN1/:2vDHob4Z+I1KBw7ajh077Puidt5ChhHN

  Score

  10^/10

  mercurialgrabberdefense_evasiondiscoveryexecutionpersistencespywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Modifies security service

    defense_evasion

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2