Extracted

• • Target

    dc182d5c9b26e7f6c54df8b516cf3b4b3a66895c85100accdc7f3751c3c60a76

  • Size

    3.6MB

  • MD5

    2efdd766c7ea80e938f375001d0b59c6

  • SHA1

    af40b328ebcb13496a1f1bc54ef21e04b15c0eac

  • SHA256

    dc182d5c9b26e7f6c54df8b516cf3b4b3a66895c85100accdc7f3751c3c60a76

  • SHA512

    5d82b9edd93cbefd6c811888b8831c2eea9f408c6e93b02f6340f4f4310222f186562b2d8bd009723d200fdb6026b1d3c1065a39b9269aa354e5454fd791b88a

  • SSDEEP

    24576:bw317sPycp8nCB3CbJE6rARaZvSn/DCQh2gqDDg0NzypyVmwXEWYdaBWmMYOLJVh:bByPnISnSuXg0VjpI2sLDkE

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2