Extracted

• • Target
    brak-pass123.exe
  • Size 41KB
  • SHA256 a00d685b9e4dce9376cb0467664c09cd2622a6e4c64021f3bc427e13f779d665
  • MD5 91e1b2495f243ded403522007982ca2f
  • SHA1 171b396da480b24527e6f4cd0a0a8c2708bb23ed
  • SHA512 85cf768baac83fda1420788db0c0fa1d3721ba4c0b1bd0a58538be0006f74ef9498b682ca351d82181aa26ff674762487dd83f7834974b23c7ccffe8c6f90e25
  • SSDEEP 768:BsclQTAvKHWOJTw3auZNeZWTjxKZKfgm3EhuL:+cKqKHHoBeZWT1F7EML
  • TLSH
    T1D8130749B7ED5708F2FF4BBE5CB240644B76B866AC32EB0E1984585D0877B808990F77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverymercurialgrabberstealerspyware

  • Family: Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2