Overview

overview

10

Static

static

3

267e274b75...c4.exe

windows7-x64

1

267e274b75...c4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21506ae1a222c3862c04d187b07ed714.bin

  • Size

    1.6MB

  • Sample

    241118-bgyrwstpgs

  • MD5

    e98a32a08a2a7ef68b17598be4bd8163

  • SHA1

    e702df2841a7aabd87343a72bf238682e6e10ea1

  • SHA256

    215431870c34a99d5a3d1c8f089f07af8742251cdc9c15075d10b900d72d2bd0

  • SHA512

    45987638f21ad8c73ba121c44cab2c1cde844c5ec1876f87b161d0409822719c724bd08748ca344642d732946d9cfb6a60b9f35bddcecd9764753b753fbfcf57

  • SSDEEP

    24576:t87f+8G9mnR84fq7UlZ4TbxOnBMN+OyyIdCfG/7GEwjojkDutoECO7W+cSfLC19/:tE2VwRfyUEngne8FHjEutoEKjOuQCRP

Score
10/10
meduzacollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

meduza

C2

45.130.145.152

Attributes
  • anti_dbg

    true

  • anti_vm

    true

  • build_name

    Work

  • extensions

    .txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite

  • grabber_max_size

    4.194304e+06

  • port

    15666

  • self_destruct

    false

Targets

    • Target

      267e274b75ba1c49847eb93d95be90b6382768926e9c3674d115c21c3cc6f2c4.exe

    • Size

      2.2MB

    • MD5

      21506ae1a222c3862c04d187b07ed714

    • SHA1

      c70d79f32b962bf2e7e7901034aaedd8f2e71e35

    • SHA256

      267e274b75ba1c49847eb93d95be90b6382768926e9c3674d115c21c3cc6f2c4

    • SHA512

      351b4739f56820e271887d953ce1fdf68e19c11e84db9325e6f03866c0fc0ec1f6072db03a4013aa914f21990367fc207bfa0f9c41452553d5960881046a034f

    • SSDEEP

      49152:NY4nch8Bu3BR8XlV10RyTXNFMnBOim8MspczpfEUL:G8VBuRR8X3iRg8kzJ

    Score
    10/10
    meduzacollectiondiscoveryspywarestealer

    • Meduza

      Meduza is a crypto wallet and info stealer written in C++.

      stealermeduza

    • Meduza Stealer payload

    • Meduza family

      meduza

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks