Extracted

• • Target

    ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a.exe

  • Size

    2.5MB

  • MD5

    cd51c014cb51d3af57ce68fe283b3714

  • SHA1

    c3245fc97924424c91a3e36a7df5833ec5b46046

  • SHA256

    ffe7b7a94481baf07af71357c2eb9fe4da46168b4e050e649ab5a7fe8631568a

  • SHA512

    da1548c461d6ed5f079c1335d7fa90a9f4401f115bb25fa210b299366e52968ff7fd448947f32b19cf57f8d034f7842fbc3fe8a51cb03dec4c2a23879df0ff61

  • SSDEEP

    24576:MoEKQByjnqh0lhSMXl6OztcajVoYPLtTPyAAewGLP23WaHK5TsjOxkmENDcv8oPc:jLzjnKOzLjVoYZPRAZGyBq58OdcDo

  Score

  10^/10

  meduzastealercollectiondiscoveryspyware

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2