Extracted

• • Target

    2024-11-15_ef69b6c7517e1bdb641b0acfedfbbffc_ryuk

  • Size

    3.6MB

  • MD5

    ef69b6c7517e1bdb641b0acfedfbbffc

  • SHA1

    bc651b9b96adfc61e53ee00f67e857af43fc6ec4

  • SHA256

    f085e411ff83f2db76a1d2f990a478c19033b75a75f88ce75b7a25cbce917a23

  • SHA512

    571aa9547e8ee39d173b0bc9a5c2087fc79ab3b9284df2eb2d1e49392c6abbd92fe0f451c7ab94d980ee9b86c66787e11898384becb5377fca2503c1294a793d

  • SSDEEP

    49152:0QusxfsC6q2Mq5d4jVLTlDlnLHpwY3AaoqHQfFNihBdp:53p

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2