Overview

overview

10

Static

static

10

16040551071.zip

windows10-2004-x64

1

9a7988742d...f9.exe

windows10-2004-x64

10

$_131_/lang-1053.dll

windows10-2004-x64

1

$_131_/lang-1054.dll

windows10-2004-x64

1

$_131_/lang-1055.dll

windows10-2004-x64

1

$_131_/lang-1056.dll

windows10-2004-x64

1

$_131_/lang-1057.dll

windows10-2004-x64

1

$_131_/lang-1058.dll

windows10-2004-x64

1

$_131_/lang-1059.dll

windows10-2004-x64

1

$_131_/lang-1060.dll

windows10-2004-x64

1

$_131_/lang-1061.dll

windows10-2004-x64

1

$_131_/lang-1062.dll

windows10-2004-x64

1

$_131_/lang-1063.dll

windows10-2004-x64

1

$_131_/lang-1065.dll

windows10-2004-x64

1

$_131_/lang-1066.dll

windows10-2004-x64

1

$_131_/lang-1067.dll

windows10-2004-x64

1

$_131_/lang-1068.dll

windows10-2004-x64

1

$_131_/lang-1071.dll

windows10-2004-x64

1

$_131_/lang-1079.dll

windows10-2004-x64

1

$_131_/lang-1081.dll

windows10-2004-x64

1

$_131_/lang-1086.dll

windows10-2004-x64

1

$_131_/lang-1087.dll

windows10-2004-x64

1

$_131_/lang-1090.dll

windows10-2004-x64

1

$_131_/lang-1092.dll

windows10-2004-x64

1

$_131_/lang-1093.dll

windows10-2004-x64

1

$_131_/lang-1102.dll

windows10-2004-x64

1

$_131_/lang-1104.dll

windows10-2004-x64

1

$_131_/lang-1109.dll

windows10-2004-x64

1

$_131_/lang-1110.dll

windows10-2004-x64

1

$_131_/lang-1155.dll

windows10-2004-x64

1

$_131_/lang-2052.dll

windows10-2004-x64

1

$_131_/lang-2070.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    16040551071.zip
  • Size 79.5MB
  • Sample240318-sl4mdabf96
  • SHA256 0b643c870600ffe2c318ff96877508d6907552989aa445e76c1598a46f7c9214
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
meduzabootkitdiscoverypersistencespywarestealer

Malware Config

Targets

    • Target
      16040551071.zip
    • Size 79.5MB
    • SHA256 0b643c870600ffe2c318ff96877508d6907552989aa445e76c1598a46f7c9214
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1
    • Target
      9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9
    • Size 79.5MB
    • SHA256 9a7988742d751d224b990e8fab540e8845e0d56173fc02ed70da8f00b15c71f9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    meduzabootkitdiscoverypersistencespywarestealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Downloads MZ/PE file

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral2
    • Target
      $_131_/lang-1053.dll
    • Size 261KB
    • SHA256 54e4138d6f61260efee1bb7cd289c7685ea603c7f9d1197cc4ac4ff7a540461f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3
    • Target
      $_131_/lang-1054.dll
    • Size 249KB
    • SHA256 c9417acf07f79faaddc29d54cf14146e8bafa63d8eb3fda3228cba7e33a396ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral4
    • Target
      $_131_/lang-1055.dll
    • Size 280KB
    • SHA256 b3b1bc0af0c9922dfa944745f303de4e5c5765faad1d69f53b0e3330f2f1dad0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5
    • Target
      $_131_/lang-1056.dll
    • Size 268KB
    • SHA256 0df9c1182d60b70ac8512d34dc2f80e089638ab3206a754a705f598e1b59ce75
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral6
    • Target
      $_131_/lang-1057.dll
    • Size 270KB
    • SHA256 e6daa5fda839c053f41e6f6435729e38e306eb4da650d3418afc53dd46beb9a5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      $_131_/lang-1058.dll
    • Size 272KB
    • SHA256 f3858bc6b709a3be8ca4e78abd669e7fbbda9550976e663544b60259fa3cc6f7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      $_131_/lang-1059.dll
    • Size 265KB
    • SHA256 4485bde9e47165f944fbcc31c04d5821a1f3f32e4b27272b693b8b48c2a39f00
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral9
    • Target
      $_131_/lang-1060.dll
    • Size 283KB
    • SHA256 946719fb2a15e63ff833118233b4b0f9fbdc65bc428f93760a2a545224fa5849
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10
    • Target
      $_131_/lang-1061.dll
    • Size 257KB
    • SHA256 3a714755af133bacd1fd93f0c2b4f7b015d22da6b197eed044cb6b1c0008eade
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11
    • Target
      $_131_/lang-1062.dll
    • Size 264KB
    • SHA256 fcaefa3c536c1eceb07245976ee50b81ccdbf3217615b4bca3fcbbc260b2c8a2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral12
    • Target
      $_131_/lang-1063.dll
    • Size 271KB
    • SHA256 911a37fe27cf61c982ed6dd714a3fa67f1eefb15ad5fec976291274864849801
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13
    • Target
      $_131_/lang-1065.dll
    • Size 266KB
    • SHA256 14ea3d971c4c9a3f3c2bd4b6c503273a3f45ce7053f8892b35e0dddf1fb38a2a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral14
    • Target
      $_131_/lang-1066.dll
    • Size 277KB
    • SHA256 51ad7095cb96e61c338a7b794ddad992a520465ff0950919c39cfa3f96ba099e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15
    • Target
      $_131_/lang-1067.dll
    • Size 95KB
    • SHA256 da072abdc5e3c1a7825aa3c08b9eb87343331bbfefc8801d9000b3cb9f229cd3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral16
    • Target
      $_131_/lang-1068.dll
    • Size 94KB
    • SHA256 18a2b150e25454e005cda52e6c4e0d62e2aecc24bb92f66803d53553cb7bec35
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17
    • Target
      $_131_/lang-1071.dll
    • Size 103KB
    • SHA256 a4b154333c2e520b02e8e896ca3476aee69ded7eff9ceeceb6812a1895a70175
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral18
    • Target
      $_131_/lang-1079.dll
    • Size 96KB
    • SHA256 cd6f51910786240e779e13f2d1dba48f4eab08bbcb72690319ae9a4509718233
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19
    • Target
      $_131_/lang-1081.dll
    • Size 269KB
    • SHA256 cbaaf264235741d88a3409795a4d112fed94876e111d8c2580bdaf4684588c61
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral20
    • Target
      $_131_/lang-1086.dll
    • Size 280KB
    • SHA256 f01fa651047b00db245f7c98cc221bb1c2fa50d26cb4679330aaa2524af2136c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21
    • Target
      $_131_/lang-1087.dll
    • Size 93KB
    • SHA256 269b1281119f30a4a9032fdc1389657fffb25b03c7d299626926f085bbc4bc00
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral22
    • Target
      $_131_/lang-1090.dll
    • Size 104KB
    • SHA256 7f0157aedb776d7dd016e7214c3bc069f052f525ec26254f53a7aaa98b6e2b0a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23
    • Target
      $_131_/lang-1092.dll
    • Size 92KB
    • SHA256 b8bc73acc5d18b1eb835724c9b90296d15c97115e470ee752499b097b9d0ecca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral24
    • Target
      $_131_/lang-1093.dll
    • Size 273KB
    • SHA256 a549dba582d3d8ab13c0d5bd3c65d643fd4be6658d2b483725043a352a9f7d35
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25
    • Target
      $_131_/lang-1102.dll
    • Size 97KB
    • SHA256 d4c30bac77916b1ab0cd7603c758e3aebc02848872f32a117540a01e81a85f24
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral26
    • Target
      $_131_/lang-1104.dll
    • Size 95KB
    • SHA256 4e69d743752fdecc241945d364c9b1a13d311b91a82a4139d4122543bd72cbd3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27
    • Target
      $_131_/lang-1109.dll
    • Size 99KB
    • SHA256 c20595cbfb5ca1142cdbb56d1e8eef59e55e2f80efa2035e9b7d6247a244cad6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral28
    • Target
      $_131_/lang-1110.dll
    • Size 94KB
    • SHA256 9cfa6385ac6046d91de6ffb447c946c977a56d6ddc69d697c626c0a27a3ed3ae
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29
    • Target
      $_131_/lang-1155.dll
    • Size 111KB
    • SHA256 f3d6f98ed33ddb7196005ede050b4a88e50d5650d30ca4404f7c37c478db2f7b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral30
    • Target
      $_131_/lang-2052.dll
    • Size 111KB
    • SHA256 954d9b3c9c1404ff0413c5370a88e9072bd80841d3fddf6316a4836e1179845d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31
    • Target
      $_131_/lang-2070.dll
    • Size 282KB
    • SHA256 f03be5e3d0e90ef126f40a254c148fc2970ba91a5978856fe71088ab697e30bb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

meduza
Score
10/10

behavioral1

Score
1/10

behavioral2

meduzabootkitdiscoverypersistencespywarestealer
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10