Extracted

• • Target

    meduza_1.bin

  • Size

    1.2MB

  • MD5

    9aedcb72e8e6d27e281aa0391466e4eb

  • SHA1

    0cdd45297f891ac6781f40107e3f2136a053a43e

  • SHA256

    f11831ae15f892b0d4e52c6f2044efdddc9597b0b61498764ef4783275b38097

  • SHA512

    1c1b9907acab6d051b1e8af22953e360a0712c9b24f0d4f5ee095306db580ea48a59e1edffa19b52ae67a4babc955e0315e50bf0c43d8ce38908de28e36ccab8

  • SSDEEP

    24576:iHKcpnRtu5KIl0gOuEu9FyDre6MRntt6bh0lhSMXlzsizw:venRtu57l0TuFoDrUV36qDY

  Score

  7^/10

  collectiondiscoveryspywarestealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1