Extracted

• • Target

    322608e24d59934b175fe0f128fc70112b69ac82ed25deb794c98f19af3204f4N.exe

  • Size

    2.0MB

  • MD5

    8ab660199d2e890e3c81e99470b0c240

  • SHA1

    00ceb01ae3691a3f3567e39f878bb4b657b82eb8

  • SHA256

    322608e24d59934b175fe0f128fc70112b69ac82ed25deb794c98f19af3204f4

  • SHA512

    c2977fc2b7a23d9d6dca02067385c6367fa586b4721e2956fc5193ec762b5e756608ab0f10fd7a6f6ac39489c8422c9e1c1aaa5dd7ba077257d9910366ed9cc4

  • SSDEEP

    49152:KWluOKJkZt0J4Nsf0wZXeFEn4ELmCdcwV0mqsu2Xf5:K0ELDV0cuW

  Score

  10^/10

  meduzacollectiondiscoverystealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2