Extracted

• • Target

    6fe2d4ac4d3769d2df1b721fd3d7647701f996ca6eef5dffa07f27aa5cd743e8.exe

  • Size

    2.0MB

  • MD5

    6f2f2f4dbad9f073f4bbf6e6755a426d

  • SHA1

    8a51ad90aea76bdd1c99d52539225f6013763883

  • SHA256

    6fe2d4ac4d3769d2df1b721fd3d7647701f996ca6eef5dffa07f27aa5cd743e8

  • SHA512

    81d7e784eb294861888555a924049110a3e6d36c63244c2298cdf0a186fc665d55339a946e3b1611141b1c3945efc9801e83e4cf3e2e4326edbf944858d6edae

  • SSDEEP

    49152:KWluOKJkZt0J4Nsf0wZXeFEn4ELmCdcwV0mqsu2Xf5u:K0ELDV0cuWc

  Score

  10^/10

  meduzacollectiondiscoverystealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2