Extracted

• • Target

    69f8cea7a5b6e5de711e9849f4bc0244f1344966364520bc12987f1b90013754.exe

  • Size

    2.5MB

  • MD5

    183e24b654414d7be786ccd8e6a108a5

  • SHA1

    a18e6d0f9d1e67f404985adfa2cc6d756e8680ac

  • SHA256

    69f8cea7a5b6e5de711e9849f4bc0244f1344966364520bc12987f1b90013754

  • SHA512

    8cb2d66a7ffe9e84b9bace8bbd859f050fbf7dc0cb9c4a262bf3467a39d3db43272d40a071fd2867e84a4cd262baa6e5347a46556dcae1a1bffa0497a147850b

  • SSDEEP

    24576:MoEKQByjnqh0lhSMXlybSXuRVRoTahOpEfc:jLzjneSan

  Score

  10^/10

  meduzastealercollectiondiscoveryspyware

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2