meduza

General

Target
Setup7.0.zip
Size 1.3MB
Sample241110-a6rt7symcp
SHA256 abdc12b4bb4b9a7309bc067be6b097a4e11b0dccbf19494edb971b510303c923
MD5 caf07843d0eec5fd5d9b131256361752
SHA1 1ce0acf5f2b521752440ce6d1c108a365a1dca50
SHA512 b72e81797f4d3264b12675e2d35c56d76ec9110c3814776068d23a51c5de20ed3bd0dd414fb3f0564633b408dc040eaf8407c5e319df7014c9249e5fbaea2839
SSDEEP 24576:kmmVkxtlqjBxiFJJ6VmNNvDcyxE1kzZefVInqEOOUy5d2DWu2vpL/tVH5fCA:kmms7WBx+JbNoyxmkzUtIDOOUyuR2h/t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

meduza

C2

109.107.181.162

Attributes

anti_dbg
true
anti_vm
true
build_name
153
extensions
none
grabber_max_size
1.048576e+06
links
none
port
15666
self_destruct
true

Targets

- Target
  Gdswt46g.DLL
- Size 12B
- SHA256 472e48643c0b957bb7c612448330f07ce0cb71e14541c6b0b9ce789bc82e91da
- MD5 dc72bdebf3016a463eb4e209af1aefe1
- SHA1 9bde7acc8b748a89daee4d756fa57ce3007e82a9
- SHA512 de6999ebc8dd931a4417c6861e36127a6b7caca1543f1db94eb90c3624045ee57398d2fb1a4841e0647ac0191ab41a04d6dc8642c7f1b888743a03a985c65ea5
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  gsdr3y4.DLL
- Size 128KB
- SHA256 563062fd6c6a2a84ebe6e35e9bb045ef1bc240cdcd20dc557c1957e80ccf932c
- MD5 d4a3019fba1509a1e1faf0115b512c84
- SHA1 cc85bc0017e4e20387c8dd0b1eaff31a5ddb473a
- SHA512 1505c567b1333a02eea5a5356ec0878c87461c22272ea693e651040df59f0677f784248f67c8d5f293be25b746596112bfed61921d6e640887f0955aab23776c
- SSDEEP 1536:cdZTYMYIKPRhJjRn4udcdugdKBH0g01+gZrxtQQzQeWV9JhtgTKzMyLL/gB:ai7ImJjeudccg00gA+AxtErtZvLjY
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  setup7.0.exe
- Size 1.7MB
- SHA256 f585f729ebcdaf7a70e16690398cca0036d1dd4c398b4044004e7ab0ccc6bf56
- MD5 2c685fc5572fee6107d76c17fa873a45
- SHA1 05436164ce59ab80e0bcae7aa779b2426866446e
- SHA512 6bd9fbf04c75c0a6a07846233e5cb31f7f8373f3bd2fc62f70f27c34d37d640d80647ca980530ba99d77586a954c73899a257e1dc2e422279a0c46f69e2107e3
- SSDEEP 49152:Fbo95a6iGYqDAtQRcsZT6jgLUcSEubOJE5eo55iRQ6Uoy:SDAtQ+sZ2jgQc7Cwk55i3
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

meduza collection discovery spyware stealer
- Meduza
  Meduza is a crypto wallet and info stealer written in C++.
  stealer meduza
- Meduza Stealer payload
- Meduza family
  meduza
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral5 behavioral6