Overview

overview

10

Static

static

3

3bf9143cb5...5d.exe

windows7-x64

10

3bf9143cb5...5d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3bf9143cb56f6f414b6a97c36bb0d85faaf5800eed96b82d8e344a39f5d6c25d.exe

  • Size

    3.6MB

  • Sample

    241107-cr6e6avrdp

  • MD5

    91b2d45daae10e1bf5348028f3785581

  • SHA1

    2c291aea85bfe99950c9c7e90bf439eb057439ae

  • SHA256

    3bf9143cb56f6f414b6a97c36bb0d85faaf5800eed96b82d8e344a39f5d6c25d

  • SHA512

    62c03bc84d04d7a982aa756ec6a6d0cfdce50fc63d0cb50ba946fd81a8359eb0f9ea6668432bdc72c35ef4ac82abcfd1325a9432a98bc6361a4dcbfb21193a8f

  • SSDEEP

    49152:bByPnIwyCv1zSXFfGo4QLaGd5GBlGJ+waRI:

Score
10/10
meduzastealer

Malware Config

Extracted

Family

meduza

C2

89.22.239.174

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    elmnov

  • extensions

    .txt

  • grabber_max_size

    4.194304e+06

  • port

    15666

  • self_destruct

    false

Targets

    • Target

      3bf9143cb56f6f414b6a97c36bb0d85faaf5800eed96b82d8e344a39f5d6c25d.exe

    • Size

      3.6MB

    • MD5

      91b2d45daae10e1bf5348028f3785581

    • SHA1

      2c291aea85bfe99950c9c7e90bf439eb057439ae

    • SHA256

      3bf9143cb56f6f414b6a97c36bb0d85faaf5800eed96b82d8e344a39f5d6c25d

    • SHA512

      62c03bc84d04d7a982aa756ec6a6d0cfdce50fc63d0cb50ba946fd81a8359eb0f9ea6668432bdc72c35ef4ac82abcfd1325a9432a98bc6361a4dcbfb21193a8f

    • SSDEEP

      49152:bByPnIwyCv1zSXFfGo4QLaGd5GBlGJ+waRI:

    Score
    10/10
    meduzastealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks