Extracted

• • Target

    8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6.exe

  • Size

    2.6MB

  • MD5

    0c01cfc0685211b3c655c7a9526f1849

  • SHA1

    864d23804b6e3c98efd1b56863a484b505ddf40b

  • SHA256

    8d6ee227c57e825bc978db47c7587d46e7df06e3656d493486ee26b1426c98a6

  • SHA512

    6024a41f371d77a82608c0e8ff314853404a50decb77838ace61c43a72ef954f4a227849b85e2aa3ef0749120e8361f13145006652596fb22b2f972bf7585719

  • SSDEEP

    49152:EZPf0tL9d77T+WScpPNBqB0+i8jS9fQzm/kv49hISc1HeW6YS3jLqFtJc:TVScpPN3D/8Sc1HeW6YSad

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2