Extracted

• • Target

    bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a.exe

  • Size

    1.7MB

  • MD5

    6ec2a541fa04ed26f3ab57062c525df7

  • SHA1

    f282b317e1127a365796abd1946b01abddf28912

  • SHA256

    bab8b9acf1a759190b26244d5e3f7315b9093270477d6d5f231245ffc38a889a

  • SHA512

    e44dbf482d4b01b8549b28b8c93ebc53b7f408197a023a2485dd702ed26a65c9667cb96c777c65367dfbff6b0c1eb08cf7e55e7a276281462d60485235eadd73

  • SSDEEP

    24576:wGbopD5a6pYGYamhD5+Pf5tWpd5GMUJx8tY9+2JuSsqSkVQX9rQochzH:dbo95a6iGYr5gfGpd5GMJtYg2HSI4Qo

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2