General
-
Target
d357d6c05936c8eb6dd5bea8ac7c251e.bin
-
Size
802KB
-
Sample
240623-d27awasbqp
-
MD5
6246c2258337ae15007e8af39bd6096b
-
SHA1
4d19fce534b89191ac6a7fc65bbc830390886a07
-
SHA256
811dbefc20a0a348038ef8f6adc70c38f9b778c20abfb85953a26dc6037a0cde
-
SHA512
63bda9b1787ccf86a9649bbe5933215a6f1b3b38e9cdcfc95d52ff11fb86d9c70dd48af9b25f8bdcc15a894414cd872a94a199a6fcb552143d9b86ef5a4c3717
-
SSDEEP
12288:40uQ02t2Nw6RYVzLcQ1T5/PIgN5KAksWR7/9fFHdsGlvpMqQmY1TXrOqyGzKXWS0:HqvXYF4bgTKAkz/9fXscoKTpe3X
Malware Config
Targets
-
-
Target
62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1.exe
-
Size
1.4MB
-
MD5
d357d6c05936c8eb6dd5bea8ac7c251e
-
SHA1
34680347e1bd884e50c279ef18a861a2067b7482
-
SHA256
62460105edf1636fd9605894deba01a417fcd8558c9a43ceefbf9fdda536a9c1
-
SHA512
4d90f5e274f66dc223c7d55ab2997fb217861fe4b8a683c03d3f46b767dfb4c3463cb9a62aeacef6527d3ea7f1699a5952659415eff4d7f3bdac48c0d3b2ef6c
-
SSDEEP
24576:tfPEX8SkcR5uPze7dH1ZkivEdLeC+fJCHLQo3u5aUC6/wA4oAH:hPEX8StRX1ZkGpCqd5a76oA
Score10/10-
Meduza
Meduza is a crypto wallet and info stealer written in C++.
-
Meduza Stealer payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-