Extracted

• • Target

    b446363802decb136351f6d7cbe7f74288c6b27d3ce6df1195d7bb455a1dc166N

  • Size

    1.5MB

  • MD5

    bfa4c290eec9bbef7a87fc4f9ef3bb80

  • SHA1

    c6c3e0baa1927aec0880af15533a796c780b480a

  • SHA256

    b446363802decb136351f6d7cbe7f74288c6b27d3ce6df1195d7bb455a1dc166

  • SHA512

    f7f9065b71c61b51d0597af4a5a0b2b18c2461f7f7cb1e317d89eb718ba5a9f59dd10dc7cba3d93a99ad8ed121bea451728653f0ff1d6d3e2c9a7d8eb42a6e25

  • SSDEEP

    49152:DMakpA5kKiJk8sxVJVJGhOXlZKPrpDtobev:BxxJAvDt7

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2