Extracted

• • Target

    c50f8f31c903a9f88b6bdec9b9f8962b.exe

  • Size

    4.1MB

  • MD5

    c50f8f31c903a9f88b6bdec9b9f8962b

  • SHA1

    39e30a482d13a431797c02a0d0c90fa9829981e2

  • SHA256

    5c6985e002a60d821fd7b029b2c5d04c3ee16bb619999202f6dbdf432d229989

  • SHA512

    6a2361e6bc5706b5ad0e8264b7767b620111d879dae1bdb463771a39422e20aac204eb25dc06c0820ec69260ffb2ae8e0d939982c865029e2252daeb9cc1f87d

  • SSDEEP

    49152:/xGK0l3e3ubtiuIv0ZVHnWmuQ5zrSmEvj1BZ:/xGK09yuQZ

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2