Extracted

• • Target

    43b9b71ba6767fda9748590734a94d570fa2553f8f056ca60e8d96a925de30e4.exe

  • Size

    1.2MB

  • MD5

    21967bfb7cd7b9091946ed7cbe908f06

  • SHA1

    69255b072edd48b464ac92e71934e74f8da6df49

  • SHA256

    43b9b71ba6767fda9748590734a94d570fa2553f8f056ca60e8d96a925de30e4

  • SHA512

    153414236a70da0efb6b2aa4f276bc6823a4c4b47b02f4c5e626fbbbef6edd64107f86ba8460ae43f85b5af3cbd700d3d9972988f89042857fc35b4a8e5c66b6

  • SSDEEP

    24576:ESCz7V96jSYOdQyUbjN5HABgRmvL/7mOhdbY7bDPq7aGsl0:EttXPEKgY3bYfDWjS0

  Score

  10^/10

  meduzacollectionstealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Detects executables packed with or use KoiVM

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2