Extracted

• • Target

    2024-11-14_75e9af53e8805c4f9f7441011cbadb12_ryuk

  • Size

    3.6MB

  • MD5

    75e9af53e8805c4f9f7441011cbadb12

  • SHA1

    6b839d3149b6e7cc73f5b62caaf365285f4aee0f

  • SHA256

    1e9873f8c0e11c4b908c8b16b0d47210135b4630b49e8ce8bbf20839110c13bd

  • SHA512

    8ede62d9032fc50c9db013e5326f3274eba613b17013aba5e209a366b0f1e56881a3f7f72719e84066d2004e65ea67c1420125d05a8d1781286d0f97af6449e4

  • SSDEEP

    24576:wiSVYduVRYxf0fXRnNja/RghhH6BVZnDnO/xPIYIvwG31eEzjuOckJSVudo0qPRM:0Qusxfsw5vZmPIfbaORpIM5JJK/M7p

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2