Extracted

• • Target

    9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32N

  • Size

    1.7MB

  • MD5

    b5d3547be863b719e29009f47f7d14a0

  • SHA1

    b7abc61f2c9eb630d38ccea349acca5345939bf7

  • SHA256

    9c5a5fa983d27dafc21ff8164169ad7772e3c0c49b32d0c5346e1854ed1d2e32

  • SHA512

    d3673cb005da62455716ffba477da8c54a3b512a0d7d8edc07ae3b766faef817a2ed8badad036de89386e83c970f88f389a63e8b8d85086095cf860c2d7fa33b

  • SSDEEP

    49152:3bo95a6iGYLWBjosANqicY0a3xdumAFMm6JhQk6pyJ:xWposANqieaXAFMth6p

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2