Extracted

• • Target

    installer.exe

  • Size

    18.7MB

  • MD5

    9cd846ea50a04e3d926b8adbfdcb9dff

  • SHA1

    1c2d7e2e672e8aa64853f8a2b6b0ff7e97117465

  • SHA256

    156cc4ef32137f0f9a8df03c32c1b0b506c72355c08bbf6f8c07279a53a7922b

  • SHA512

    1b60385c3df8a331f3824954532262d63c7218459e1d7241b37c652520510e68d300d620b31f74492942a705434c740f336c44482ddebc1c04db60e4b50a933f

  • SSDEEP

    98304:eI0CniMX77777773773W/lcCjQI7wnHsv8pMCTzSAhmyhJONL+L8JCE8fh9mdJOW:Nii77777773773WICRPZQ2isH

  Score

  10^/10

  meduzacollectiondiscoveryexecutionspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4