Extracted

• • Target

    Setup.zip

  • Size

    1.3MB

  • MD5

    05985f52b6aa68ae26e6c5cc4d9a671b

  • SHA1

    1282190b4dcd7e6c277cafb7bfd3535ca697e2d9

  • SHA256

    a16651c9afd3eda3a5f29c9be9d57c739bc8bb96b982761163e61b1bfd36d1ae

  • SHA512

    2175cdb9b2c8b7419fcfc363817fa0f53269d25d7d0b38f2d27f6fc1f59b7c341186b79c2347ea2cb9fe3a1f06094fbcc23f06d226f66a91ade5d1206db1f0a8

  • SSDEEP

    24576:Zmm7ot3urRHoBykevlYzH5RIosGBaTCYYea598ZsUE:Zmm7m3HAl4H5RdsMaTCVjbYc

  Score

  1^/10
  behavioral1behavioral2

• • Target

    NewsStatV2.DLL

  • Size

    12B

  • MD5

    dc72bdebf3016a463eb4e209af1aefe1

  • SHA1

    9bde7acc8b748a89daee4d756fa57ce3007e82a9

  • SHA256

    472e48643c0b957bb7c612448330f07ce0cb71e14541c6b0b9ce789bc82e91da

  • SHA512

    de6999ebc8dd931a4417c6861e36127a6b7caca1543f1db94eb90c3624045ee57398d2fb1a4841e0647ac0191ab41a04d6dc8642c7f1b888743a03a985c65ea5

  Score

  1^/10
  behavioral3behavioral4

• • Target

    NewsStatV2.ini

  • Size

    213B

  • MD5

    369c4e55c3bbd2fde0057a1001aab99b

  • SHA1

    c6576a7d886a0c7738b64808988102ae22d7b46e

  • SHA256

    c16d5f5b6e266ae6321451c7a8d547532cb65e30f089ab70072159b1047c5b02

  • SHA512

    d42f486318d50898cd6e516f01dcc08e9adc53ba9029e2bd7af263f526b41e7e955e7d33f90300a5c5fa392e5b7336c6e0bcea0169e7877808da63cfdd8cc54b

  Score

  1^/10
  behavioral5behavioral6

• • Target

    Setup.exe

  • Size

    1.7MB

  • MD5

    f1bca393ebf7d5de3fc6b0f3b2531a45

  • SHA1

    e6323fcf662fd477bb3145021495380d1f88d36f

  • SHA256

    c4722166ddccf45c4b8760f61326ab4c34c9fe5a4ae23b8c34195b728d19bac3

  • SHA512

    7aab0d2b4cd5608c5caaa8fefdbc39283722b05be9e7e8f0e05e8fbfdcf003d1a2ba0a3dd3afba21e7ad167a2ebbb0603db06d71b74f1dea769cf56082620280

  • SSDEEP

    49152:bK+/T/rL4gdI+QOoAhKgrqAwHsnxFP18:RQuLF

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral7behavioral8

• • Target

    Sеtuр2.0/StatCache.db

  • Size

    32B

  • MD5

    1dd2d16062a18a70a3cf13fc6073c6ca

  • SHA1

    192efc58cbd5befcddce69a913ab9a69a9759af1

  • SHA256

    6feaca71463ac85e0778ef25c5572c6ab6f04d02a2ce5fa513533933ae7c15ef

  • SHA512

    5f457fbcf37fe54ed2aa761e952d8783a4f138cc5fa2028bf99e8f08f76bacdf8557e1310b03e260982d2ecd99f7e7f9ec2716892fcbb9e72c1886f39e07f879

  Score

  3^/10
  behavioral10behavioral9

• • Target

    Sеtuр2.0/StatCache3.db

  • Size

    32B

  • MD5

    6ff7763ec692b79e38ad1cc00467b109

  • SHA1

    bf3b027a91fbf63da320da25de1a50bf38acf2a9

  • SHA256

    6a2147d62db884de9f43488c8ffb76648d5985c937fdf261617312df9c0eef58

  • SHA512

    295616b279698edcb4aceb64bd7cfe870b748b4c3bdafa6a4c95b39bf15449b33ef5105ef6da5c8ca0b8006dedf4544e3fb6aa1f7bc66e74d5638006651fa20d

  Score

  3^/10
  behavioral11behavioral12

• • Target

    p2pstate.DLL

  • Size

    128KB

  • MD5

    d4a3019fba1509a1e1faf0115b512c84

  • SHA1

    cc85bc0017e4e20387c8dd0b1eaff31a5ddb473a

  • SHA256

    563062fd6c6a2a84ebe6e35e9bb045ef1bc240cdcd20dc557c1957e80ccf932c

  • SHA512

    1505c567b1333a02eea5a5356ec0878c87461c22272ea693e651040df59f0677f784248f67c8d5f293be25b746596112bfed61921d6e640887f0955aab23776c

  • SSDEEP

    1536:cdZTYMYIKPRhJjRn4udcdugdKBH0g01+gZrxtQQzQeWV9JhtgTKzMyLL/gB:ai7ImJjeudccg00gA+AxtErtZvLjY

  Score

  1^/10
  behavioral13behavioral14