meduza | 173003262794649fd566ac9fa2f5c76908d8d3540e8fb3570acefd08985c49bb9528c6e5f3515[.]dat-decoded[.]exe

General

Target
173003262794649fd566ac9fa2f5c76908d8d3540e8fb3570acefd08985c49bb9528c6e5f3515.dat-decoded.exe
Size 1.3MB
Sample241027-pt27qsxemd
SHA256 d82fe3ed607a8d4827f6b8f007bae911b7201e9af927ffb7442d571347903ab8
MD5 ec508f4911e5a23f6c0f5d415bd3afd7
SHA1 153589b6d13c5a647028566de0e70b3c8982316e
SHA512 6c6450e67102f27748fe1f0b20643955d7724b96901dea9caa7d84ad4a11f7d5090b76e9fd7d8195f8418f0949db2dbc3a3c656c472474dd19fefc4749c0a8b4
SSDEEP 24576:HKG7DZFbFY/BOx4F/MSxVM0j7Ro/IbGw/eGjm7L0K5FpwR8XZyOY7G13E:H3bFY/BdF/MSxVhC/IbGw/9mvP5FDZH3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meduza

Malware Config

Signatures

Meduza Stealer payload 1 IoCs

resource	yara_rule
sample	family_meduza

Meduza family
meduza

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
173003262794649fd566ac9fa2f5c76908d8d3540e8fb3570acefd08985c49bb9528c6e5f3515.dat-decoded.exe

File Explorer

173003262794649fd566ac9fa2f5c76908d8d3540e8fb3570acefd08985c49bb9528c6e5f3515.dat-decoded.exe

.exe 1.3MB

173003262794649fd566ac9fa2f5c76908d8d3540e8fb3570acefd08985c49bb9528c6e5f3515.dat-decoded.exe

SHA256 d82fe3ed607a8d4827f6b8f007bae911b7201e9af927ffb7442d571347903ab8
MD5 ec508f4911e5a23f6c0f5d415bd3afd7
SHA1 153589b6d13c5a647028566de0e70b3c8982316e
SHA512 6c6450e67102f27748fe1f0b20643955d7724b96901dea9caa7d84ad4a11f7d5090b76e9fd7d8195f8418f0949db2dbc3a3c656c472474dd19fefc4749c0a8b4
SSDEEP 24576:HKG7DZFbFY/BOx4F/MSxVM0j7Ro/IbGw/eGjm7L0K5FpwR8XZyOY7G13E:H3bFY/BdF/MSxVhC/IbGw/9mvP5FDZH3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Meduza Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

716032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

851KB

Virtual Size

850KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

373KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

173003262794649fd566ac9fa2f5c76908d8d3540e8fb3570acefd08985c49bb9528c6e5f3515.dat-decoded.exe

generic