Extracted

• • Target

    9d1701e0510ea2a76a1292999d89627ba30384bcb7eacc3000e331ba728bf8ad.exe

  • Size

    2.5MB

  • MD5

    713454ca909efaf3a83b636423a6c248

  • SHA1

    6c197870b9646b90f5b55bdcd4cfd07019864e98

  • SHA256

    9d1701e0510ea2a76a1292999d89627ba30384bcb7eacc3000e331ba728bf8ad

  • SHA512

    8a31b7fdfe7a4d1c21f7af401e14c7ae7b420e66bab2fc8310c1341fc8b559a80a12b6b3fb1544358f1e505eb931e466abdf1bd3289618846c4a9167b789a80b

  • SSDEEP

    24576:xf2KQ7MvYPh0lhSMXlJu78bG8AQs7QZqxwB42EyuzCBorM5c9ech:tpHvZM78b9Ab7aTEZzwoN

  Score

  10^/10

  meduzastealercollectiondiscoveryspyware

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2