Extracted

• • Target

    92926adf402368d754fd1eabf96adbc526e791a2aa6da3c63d0b9e9db91212a2N

  • Size

    1.7MB

  • MD5

    27b360b2dfc1dc9f768a9926dbb0c520

  • SHA1

    cf38d9ea51288e5d7a7678dc5c2af374c9308a5d

  • SHA256

    92926adf402368d754fd1eabf96adbc526e791a2aa6da3c63d0b9e9db91212a2

  • SHA512

    aa0292f595b32fd89573fcfb1ccb3972e2e6e1d532e0356d50d09efb68582e02eacc75419bcd33e2f59e7b5b1e8f90b5485698177b40a15fdfcc8cc61a7227ff

  • SSDEEP

    49152:ebo95a6iGYZZ3ZQ/TofdJ0C2qJ8+eDZuEAI2CKEKwIR:0zqTofdJ1FDelAI2CKED

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2