Extracted

• • Target

    ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef.exe

  • Size

    1.4MB

  • MD5

    82eecea4083e39c33733428c2d845b15

  • SHA1

    02cfb61e8cb6242890cf58e25c26136d4ce46709

  • SHA256

    ebd41d486952eddaa670358497f33abc615cd311fca173b8833575893aea83ef

  • SHA512

    4528e6033ea1cf4a0de232d3ec74bffead24d17dd2d4a2ceac4f73f2e2b94babd53e14bc9eca5661c41f4692b730d9096f5255936c19de7b2671bf8f226899df

  • SSDEEP

    24576:Yr3uXCxRUKRErpNT3ixen3EyJvRvEx+aFwGSMn/FQiG654Sr:Yreyx7ErOe3XvRvRayM/FU+4s

  Score

  10^/10

  meduzastealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2