Extracted

• • Target

    Aura.exe

  • Size

    2.7MB

  • MD5

    3567ee60deb35afd811a25424c9b13a8

  • SHA1

    850f2bf4dbd2e569a9aca863402c392226753956

  • SHA256

    7a88ac88cd9a64ac367e048c1ce14a6fb31d5025a95e8ff6fc42730ac3f941a3

  • SHA512

    a004731ba7d2abdf8bd1691ef98356da7e9119d1d7d281d824d9229a21acbf6a82801620250eafec63bbf5d09817b5ae93776d8721543a2a7e1bd2ecbe80c20a

  • SSDEEP

    49152:kPw34yFJzSdhPzD0mOd4606hU6HznMO8ieMB2FT9m+49UYl1VGZS+M:H9mOd46WO8lFU9XV9

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2