Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Setup.zip

  • Size

    1.3MB

  • Sample

    241003-14fl9szamp

  • MD5

    05985f52b6aa68ae26e6c5cc4d9a671b

  • SHA1

    1282190b4dcd7e6c277cafb7bfd3535ca697e2d9

  • SHA256

    a16651c9afd3eda3a5f29c9be9d57c739bc8bb96b982761163e61b1bfd36d1ae

  • SHA512

    2175cdb9b2c8b7419fcfc363817fa0f53269d25d7d0b38f2d27f6fc1f59b7c341186b79c2347ea2cb9fe3a1f06094fbcc23f06d226f66a91ade5d1206db1f0a8

  • SSDEEP

    24576:Zmm7ot3urRHoBykevlYzH5RIosGBaTCYYea598ZsUE:Zmm7m3HAl4H5RdsMaTCVjbYc

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Targets

    • Target

      Setup.zip

    • Size

      1.3MB

    • MD5

      05985f52b6aa68ae26e6c5cc4d9a671b

    • SHA1

      1282190b4dcd7e6c277cafb7bfd3535ca697e2d9

    • SHA256

      a16651c9afd3eda3a5f29c9be9d57c739bc8bb96b982761163e61b1bfd36d1ae

    • SHA512

      2175cdb9b2c8b7419fcfc363817fa0f53269d25d7d0b38f2d27f6fc1f59b7c341186b79c2347ea2cb9fe3a1f06094fbcc23f06d226f66a91ade5d1206db1f0a8

    • SSDEEP

      24576:Zmm7ot3urRHoBykevlYzH5RIosGBaTCYYea598ZsUE:Zmm7m3HAl4H5RdsMaTCVjbYc

    Score
    1/10
    • Target

      NewsStatV2.DLL

    • Size

      12B

    • MD5

      dc72bdebf3016a463eb4e209af1aefe1

    • SHA1

      9bde7acc8b748a89daee4d756fa57ce3007e82a9

    • SHA256

      472e48643c0b957bb7c612448330f07ce0cb71e14541c6b0b9ce789bc82e91da

    • SHA512

      de6999ebc8dd931a4417c6861e36127a6b7caca1543f1db94eb90c3624045ee57398d2fb1a4841e0647ac0191ab41a04d6dc8642c7f1b888743a03a985c65ea5

    Score
    1/10
    • Target

      NewsStatV2.ini

    • Size

      213B

    • MD5

      369c4e55c3bbd2fde0057a1001aab99b

    • SHA1

      c6576a7d886a0c7738b64808988102ae22d7b46e

    • SHA256

      c16d5f5b6e266ae6321451c7a8d547532cb65e30f089ab70072159b1047c5b02

    • SHA512

      d42f486318d50898cd6e516f01dcc08e9adc53ba9029e2bd7af263f526b41e7e955e7d33f90300a5c5fa392e5b7336c6e0bcea0169e7877808da63cfdd8cc54b

    Score
    1/10
    • Target

      Setup.exe

    • Size

      1.7MB

    • MD5

      f1bca393ebf7d5de3fc6b0f3b2531a45

    • SHA1

      e6323fcf662fd477bb3145021495380d1f88d36f

    • SHA256

      c4722166ddccf45c4b8760f61326ab4c34c9fe5a4ae23b8c34195b728d19bac3

    • SHA512

      7aab0d2b4cd5608c5caaa8fefdbc39283722b05be9e7e8f0e05e8fbfdcf003d1a2ba0a3dd3afba21e7ad167a2ebbb0603db06d71b74f1dea769cf56082620280

    • SSDEEP

      49152:bK+/T/rL4gdI+QOoAhKgrqAwHsnxFP18:RQuLF

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

    • Meduza Stealer payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    • Target

      Sеtuр2.0/StatCache.db

    • Size

      32B

    • MD5

      1dd2d16062a18a70a3cf13fc6073c6ca

    • SHA1

      192efc58cbd5befcddce69a913ab9a69a9759af1

    • SHA256

      6feaca71463ac85e0778ef25c5572c6ab6f04d02a2ce5fa513533933ae7c15ef

    • SHA512

      5f457fbcf37fe54ed2aa761e952d8783a4f138cc5fa2028bf99e8f08f76bacdf8557e1310b03e260982d2ecd99f7e7f9ec2716892fcbb9e72c1886f39e07f879

    Score
    3/10
    • Target

      Sеtuр2.0/StatCache3.db

    • Size

      32B

    • MD5

      6ff7763ec692b79e38ad1cc00467b109

    • SHA1

      bf3b027a91fbf63da320da25de1a50bf38acf2a9

    • SHA256

      6a2147d62db884de9f43488c8ffb76648d5985c937fdf261617312df9c0eef58

    • SHA512

      295616b279698edcb4aceb64bd7cfe870b748b4c3bdafa6a4c95b39bf15449b33ef5105ef6da5c8ca0b8006dedf4544e3fb6aa1f7bc66e74d5638006651fa20d

    Score
    3/10
    • Target

      p2pstate.DLL

    • Size

      128KB

    • MD5

      d4a3019fba1509a1e1faf0115b512c84

    • SHA1

      cc85bc0017e4e20387c8dd0b1eaff31a5ddb473a

    • SHA256

      563062fd6c6a2a84ebe6e35e9bb045ef1bc240cdcd20dc557c1957e80ccf932c

    • SHA512

      1505c567b1333a02eea5a5356ec0878c87461c22272ea693e651040df59f0677f784248f67c8d5f293be25b746596112bfed61921d6e640887f0955aab23776c

    • SSDEEP

      1536:cdZTYMYIKPRhJjRn4udcdugdKBH0g01+gZrxtQQzQeWV9JhtgTKzMyLL/gB:ai7ImJjeudccg00gA+AxtErtZvLjY

    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks