Extracted

• • Target

    0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d.exe

  • Size

    4.1MB

  • MD5

    c3e44b324eb2145c756c3e5de7b4defb

  • SHA1

    150238e4629d6941f95d1ab7a6e84897e5bbabd9

  • SHA256

    0f8b8e294577598a477970e3e2ac5b5a1bda0b90aacb61eca90b2b1cb80a119d

  • SHA512

    2776571ddd9b023b8452c2e892505607a83aab44c88031e440cb6e099e48d3f22e488c640e662086a83cf7801c23f24547d00e3010cae2cf2111e912a2618047

  • SSDEEP

    49152:xXmM3+IVJiicn3HpKoQyvf7+MsgFYengla6MuBWcywgSzLXduCtr8U:KdVjnaJ8dwWTwgSlf

  Score

  10^/10

  meduzacollectionstealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2