Extracted

• • Target

    BTC-Stealer.exe

  • Size

    201.3MB

  • MD5

    de367e953006531022f59c6c3700e4b4

  • SHA1

    ea0383a88ba077c29cfbbd5c14ffc03497d0fea3

  • SHA256

    3b3e5cd21b9ee308ce4a04e1a7a1f0f2c5f44fc6633300b57bddd3ffa41a04e3

  • SHA512

    a043571e267131eded7a04f9221e8cb8f5ba7608fadf2a48bed6fc2ab5f98a157ab375bff4c342755dad64e994cc545c07fe919f1e52c649a640f1f6019f41ab

  • SSDEEP

    6144:SitPBXe1j1agJRe6qTF38D6t6HTOJcmhrf:SuBmagJRe6qc6t6z2f

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3