meduza | 7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356.exe
Size 901KB
Sample240822-b8q65asdmb
SHA256 7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356
MD5 36c1f4bde9faa23abacb87a2d090ce77
SHA1 db53a9d930e8bc480e1e1b10abbf1fab158814c7
SHA512 99034156dea9a2881a9eabd05732087f197128ad0008fe3bfeaedfdb9d91867e78b71255d7bc3c9ef0d90d4c72bd7ac8ab0f68a0c81eb7d752b40c48c6c6f42a
SSDEEP 24576:VrpRrJq00ihAcWgudeIPDMJD0n5xs70ivjt:1pRrJqNihA4XD0n5GQiv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meduza

Malware Config

Signatures

Meduza Stealer payload 1 IoCs

resource	yara_rule
sample	family_meduza

Meduza family
meduza

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356.exe

File Explorer

7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356.exe

.exe 901KB

7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356.exe

IMPHASH 2d0a5beab2cc32f0d0a2af98aef9f47b
SHA256 7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356
MD5 36c1f4bde9faa23abacb87a2d090ce77
SHA1 db53a9d930e8bc480e1e1b10abbf1fab158814c7
SHA512 99034156dea9a2881a9eabd05732087f197128ad0008fe3bfeaedfdb9d91867e78b71255d7bc3c9ef0d90d4c72bd7ac8ab0f68a0c81eb7d752b40c48c6c6f42a
SSDEEP 24576:VrpRrJq00ihAcWgudeIPDMJD0n5xs70ivjt:1pRrJqNihA4XD0n5GQiv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Meduza Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

641468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup htons inet_pton WSAStartup send socket connect recv closesocket

crypt32

CryptUnprotectData

wininet

InternetQueryDataAvailable InternetReadFile HttpQueryInfoW InternetCloseHandle InternetOpenW InternetOpenUrlA InternetOpenA

ntdll

NtQueryObject NtQuerySystemInformation

rstrtmgr

RmStartSession RmEndSession RmGetList RmRegisterResources

kernel32

FindFirstFileW FindNextFileW FindClose OpenProcess CreateToolhelp32Snapshot Process32NextW LoadLibraryA Process32FirstW CloseHandle GetSystemInfo GetProcAddress ReadProcessMemory FreeLibrary VirtualQueryEx MultiByteToWideChar LocalFree WideCharToMultiByte TerminateProcess GetModuleFileNameW CreateMutexA ReleaseMutex OpenMutexA ExitProcess ReadFile GetModuleFileNameA GetVolumeInformationW GetGeoInfoA HeapFree EnterCriticalSection GetCurrentProcess GetProcessId GetProductInfo LeaveCriticalSection SetFilePointer InitializeCriticalSectionEx FreeEnvironmentStringsW GetModuleHandleA HeapSize GetLogicalDriveStringsW GetFinalPathNameByHandleA GetTimeZoneInformation GetLastError HeapReAlloc GetNativeSystemInfo HeapAlloc GetUserGeoID DecodePointer GetFileSize DeleteCriticalSection GetComputerNameW GetProcessHeap GlobalMemoryStatusEx GetModuleHandleW GetEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc VirtualProtect VirtualQuery GetCurrentThreadId GetStdHandle GetFileType GetStartupInfoW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode ReadConsoleW RaiseException IsValidCodePage GetACP GetOEMCP SetEndOfFile GetStringTypeW GetModuleHandleExW SetStdHandle CreateFileW WriteConsoleW OutputDebugStringW SetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter InitializeSListHead RtlUnwindEx RtlUnwind RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringEx LCMapStringEx GetFileInformationByHandleEx IsDebuggerPresent GetCommandLineA GetCommandLineW RtlVirtualUnwind GetCPInfo AreFileApisANSI GetFileAttributesExW GetFileAttributesW FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA

user32

GetWindowRect GetDC EnumDisplayDevicesW ReleaseDC GetSystemMetrics GetDesktopWindow

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC BitBlt DeleteDC GetObjectW DeleteObject GetDeviceCaps

advapi32

GetCurrentHwProfileW RegCloseKey RegQueryValueExA OpenProcessToken RegOpenKeyExA GetUserNameW RegEnumKeyExA GetTokenInformation CredEnumerateA CredFree

shell32

ShellExecuteW SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal CoTaskMemFree

shlwapi

ord214 ord213 ord184

gdiplus

GdipAlloc GdipGetImageEncoders GdipDisposeImage GdipFree GdiplusStartup GdipCreateBitmapFromHBITMAP GdipCloneImage GdipCreateBitmapFromScan0 GdiplusShutdown GdipGetImageEncodersSize GdipSaveImageToStream

Name

.text

Size

726KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7ca0be077e863ab4f7babbcba1b40e819a7d2e6f5fbabe27fbfe7a125b8be356.exe

ws2_32

crypt32

wininet

ntdll

rstrtmgr

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

gdiplus

generic