Mercurial Grabber.exe -

It silently scans for the targeted files and browser databases.

Includes basic anti-debugging and anti-VM (Virtual Machine) checks to detect if it is being run by a security researcher in a sandbox. Delivery Methods Mercurial Grabber.exe

Collects machine info, including Windows product keys, IP addresses, hardware specs, and desktop screenshots. It silently scans for the targeted files and

Some variants copy themselves to %APPDATA%\Local\Temp and add a registry key to ensure they run every time the computer reboots. Malware Type: Infostealer / Credential Grabber

Extracts stored passwords, cookies, and autofill data from popular browsers like Google Chrome, Opera, Brave, and Yandex .

Below is a technical breakdown of its typical behavior, delivery, and impact. Malware Type: Infostealer / Credential Grabber.

Prioritize Discord, email, and gaming accounts. If you have 2FA enabled, your session tokens might still be at risk until you log out of all sessions.