Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8f2f1b271e44c49b2b043876a8e9f365c3815c03f3c1331027cad80b7566ec1eN
-
Size
1.8MB
-
Sample
241110-hy6x6asbqr
-
MD5
73c029443b70522bce882f639e623f40
-
SHA1
37a1872ebbdf38de87cff3fa105b10bc74d850ce
-
SHA256
8f2f1b271e44c49b2b043876a8e9f365c3815c03f3c1331027cad80b7566ec1e
-
SHA512
323191e2dec0781044daa347d5352ae383870acfd7391e08859a8264db043e48b17b2618a07467f8f0f8a1702c74ea5885aa1bbdb6ff61e5040ac0ad314acfde
-
SSDEEP
24576:RQKhhnL1+adN1evzG4e0h0lhSMXlCM9uYYeniAs87LnhJMYeZzMTvej+X2:CKhhnUnQ99uYPiAsKxTm5
Static task
static1
Behavioral task
behavioral1
Sample
8f2f1b271e44c49b2b043876a8e9f365c3815c03f3c1331027cad80b7566ec1eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8f2f1b271e44c49b2b043876a8e9f365c3815c03f3c1331027cad80b7566ec1eN.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
meduza
195.133.18.88
-
anti_dbg
false
-
anti_vm
false
-
build_name
mango
-
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite;.kdbx
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Targets
-
-
Target
8f2f1b271e44c49b2b043876a8e9f365c3815c03f3c1331027cad80b7566ec1eN
-
Size
1.8MB
-
MD5
73c029443b70522bce882f639e623f40
-
SHA1
37a1872ebbdf38de87cff3fa105b10bc74d850ce
-
SHA256
8f2f1b271e44c49b2b043876a8e9f365c3815c03f3c1331027cad80b7566ec1e
-
SHA512
323191e2dec0781044daa347d5352ae383870acfd7391e08859a8264db043e48b17b2618a07467f8f0f8a1702c74ea5885aa1bbdb6ff61e5040ac0ad314acfde
-
SSDEEP
24576:RQKhhnL1+adN1evzG4e0h0lhSMXlCM9uYYeniAs87LnhJMYeZzMTvej+X2:CKhhnUnQ99uYPiAsKxTm5
Score10/10-
Meduza Stealer payload
-
Meduza family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-