Extracted

• • Target

    2024-11-19_21d65d2084afc22c1bd35c189267b6bc_ryuk

  • Size

    4.1MB

  • MD5

    21d65d2084afc22c1bd35c189267b6bc

  • SHA1

    281e6c35c9753b4153590bd798bc98f670a837d3

  • SHA256

    39e05855169379fd9a0710b68a5bc7a07bf8d5579587aaef3bab08d170adb35a

  • SHA512

    04be8a8f97aa693aeadd326aa0e513f707be3fa21af4d2ea491435cc485af68dff2b800e205a83fe4dc57628b6ec1efb693d0c96af5369b276abde08b100b961

  • SSDEEP

    49152:qxGK0l3e3uY1SLWM8ae2kJjAIrc4kSFIK9k/kW9ZrV7xCcxyRY4WsZ:qxGK09yuCZ

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2