Extracted

• • Target

    fd1b8111563b380cc32a3ded5cb18351.exe

  • Size

    2.0MB

  • MD5

    fd1b8111563b380cc32a3ded5cb18351

  • SHA1

    8d434615209c932c5cd9d819e60717ba40426b7f

  • SHA256

    b174f3ba74f08dab33a60a99b4c6a1fa7d021a20b68283a15d82c84367c2c28d

  • SHA512

    a9011855602c27959fd59036475e34a3e56e59042693018f11fec4f89c35e1ced6ca88f04862c467a7fc37d21a96e865605bb7b178c0ab1948386d1bcf29bc3c

  • SSDEEP

    49152:bWluOKJkZt0J4Nsf0wZXeFCn4ELmCdcwV0mqsu2Qf5:b+ELDV0cuR

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2