Extracted

• • Target

    test.exe

  • Size

    41KB

  • MD5

    1cdef1bb03b387ab03056679a76fbb9a

  • SHA1

    fcad7bf599054bfc1d5308575edf1b3f059b5740

  • SHA256

    62a2a9c372635344dee03d3e875ca555910cc8f95e139cf44e653f5c267a4350

  • SHA512

    c9d423cfe2d0ac05ec4f7163c1a1fcfa9776a100ac885bf6dff36542d4b37cf62511eeeb8c594fbf241a2212dd8336b366d3734af7d2fdf5ab65e4994c60d11b

  • SSDEEP

    768:gscaIyIde8bH5M/BgwJuZPeE7WTj5KZKfgm3EhWS:Xc1He86IeE7WT9F7EAS

  Score

  10^/10

  mercurialgrabberdefense_evasionstealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1