Extracted

• • Target

    bf6b40d0404e6d543f60b7c4079d2d029a6b85b5739023f3ed8c87aca735cd41N

  • Size

    1015KB

  • MD5

    654d8e797563258db972fc2b74d63860

  • SHA1

    e5377b67e02a59c30925d65ba3b024966584acd1

  • SHA256

    bf6b40d0404e6d543f60b7c4079d2d029a6b85b5739023f3ed8c87aca735cd41

  • SHA512

    e7c4df68be0c19add99134e82e806c7ec0209e60f9137dbbc9b3b2bf402e0d1828b0928c09dc0d91a6196c5628021cb8798e0028d90dad4f040a7a635b98c346

  • SSDEEP

    24576:+PTNOyieIh0lhSMXlF6KuMokYZUUSpzCmip:+bNHPdYKuMorZUUSB

  Score

  10^/10

  meduzastealercollectiondiscoveryspyware

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2