Mercurial Grabber Malware Builder

Mercurial Grabber is an open-source C# stealer builder that has been repurposed by threat actors to harvest browser credentials and cookies (Chrome, Roblox, Minecraft), Windows product keys, Discord tokens, system and geolocation details, and screenshots. The analysis documents its persistence, anti-VM/anti-debug checks, embedded SQLite and AES-GCM encryption, configurable C2 communications, MITRE ATT&CK mappings, IoCs (SHA-1/SHA-256 hashes), and recommends standard defensive measures (MFA, updates, antivirus, cautious handling of pirated software and phishing).