Extracted

• • Target

    2aa321a93bfa09139831e510e3cf9a869ece3d2e00889c846be169963cbb3b34

  • Size

    1.6MB

  • MD5

    93ca970bf446580ce800feb9c3973304

  • SHA1

    c442d46a3bf7abe905f854d2ef5a8bd1ffcef2a8

  • SHA256

    2aa321a93bfa09139831e510e3cf9a869ece3d2e00889c846be169963cbb3b34

  • SHA512

    620213b690cca096a9deb426ab8193394cbb7eaadcbc6c8ead570354f7f265013cac11c8491a2f362c124f643ac0b318161c96c00f0292b0f6bf9426537a0450

  • SSDEEP

    49152:2wimY9PZYPy3bcJnmPgiM+7Zjryr5uCZRk4K25b:2wihPZyyBxVjrwV75b

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2