Extracted

• • Target

    41eda52877bd4d19632d6e5860e492b5d8accf923fc40c4604bece5491bda4a3.bin

  • Size

    2.4MB

  • MD5

    4d91fd816d2bac403f052f864bcd62dc

  • SHA1

    f861a0f192ae3bc05d993dcdafd667df30c43d13

  • SHA256

    41eda52877bd4d19632d6e5860e492b5d8accf923fc40c4604bece5491bda4a3

  • SHA512

    31c4ffca08050116bf0237fd42f0b9a800d5a3535eaf6a604b4fac0a0ac0827de727773f5e618e44d8975967d8c499629c04612f2f51d7d43b464d273508bc1f

  • SSDEEP

    49152:ym3c8RgY8M2lBfNGy8Tt5nVzZTM3pyoaz+vXcDLbx4/XlbdZ0/TkBipmTzn:75y8Tt5r0azFLmv0/IBS0z

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2