Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2024-11-07_4749a14d4e7627a3eec30b9d9f0f362f_ryuk

  • Size

    3.6MB

  • Sample

    241107-c6t1nssnhz

  • MD5

    4749a14d4e7627a3eec30b9d9f0f362f

  • SHA1

    95623403953d62a30d527972b50a61402d32d1c2

  • SHA256

    505735a9c0259f19cd8a9afdcdd91f5fe2d68bd50f8a8b4c0270ad4195f6f064

  • SHA512

    1eebdcb9ac59ad35c543d6fe9d365c0699c9fe32e93edc53cad94c2fab518896699e109deaf485f9e3b9a120ad9a58c090c44aa5df45ebab0ed2e9ddcfe8c0d9

  • SSDEEP

    24576:bw317sPycp8nCB3C3i8ujopI8BHGVRFdQI+TXiqDv7eQYmDCaKzmqiozjOlY0jdE:bByPnIdoRGDnzmDntUCd+

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    589

  • extensions

    none

  • grabber_max_size

    1.048576e+06

  • links

    none

  • port

    15666

  • self_destruct

    true

Targets

    • Target

      2024-11-07_4749a14d4e7627a3eec30b9d9f0f362f_ryuk

    • Size

      3.6MB

    • MD5

      4749a14d4e7627a3eec30b9d9f0f362f

    • SHA1

      95623403953d62a30d527972b50a61402d32d1c2

    • SHA256

      505735a9c0259f19cd8a9afdcdd91f5fe2d68bd50f8a8b4c0270ad4195f6f064

    • SHA512

      1eebdcb9ac59ad35c543d6fe9d365c0699c9fe32e93edc53cad94c2fab518896699e109deaf485f9e3b9a120ad9a58c090c44aa5df45ebab0ed2e9ddcfe8c0d9

    • SSDEEP

      24576:bw317sPycp8nCB3C3i8ujopI8BHGVRFdQI+TXiqDv7eQYmDCaKzmqiozjOlY0jdE:bByPnIdoRGDnzmDntUCd+

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

    • Meduza Stealer payload

    • Meduza family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks