Extracted

• • Target

    Mercurial.Grabber.v1.03.rar

  • Size

    94KB

  • MD5

    0ec5027161e49223bfbfe40321592511

  • SHA1

    1ba9f950d283058f0b41b0ece5f3becff811fd9c

  • SHA256

    371edb664c31555dac5e695b0f7286115dd94b380c188948bde2f167f030a7d3

  • SHA512

    809b69857661727a2f26cb4c0921e29e012ebbc998b3fe7cc1b6b24d973b51b15cdcb512f38cf37ae220ff346ced85056fedac786db36707c59fea952953133e

  • SSDEEP

    1536:fKsbf1SvOpAtcQZrlImqPqEvSGkbJ4pBJXK/YnNnJbbeygbZuJi:ysjIvJcQZDaqjbuPJXK/cJbbyIi

  Score

  10^/10

  mercurialgrabberdefense_evasionspywarestealer

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Mercurialgrabber family

    mercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2