Extracted

• • Target

    b337bdf938137f924c012750a78a873b5665ed42841921b22f47cf374e219da4N.exe

  • Size

    2.0MB

  • MD5

    ffc43645009041ac33e5e2cffe558630

  • SHA1

    daa410d0ba7da296ce9ac4535d4ff33cfbc1838e

  • SHA256

    b337bdf938137f924c012750a78a873b5665ed42841921b22f47cf374e219da4

  • SHA512

    b3a07bfc8f05c1de9a3260de30d3ce2a106a6004cdae5720597ec0063c09a5996b23b9736fc863d848ef20159f0cd1a4fd454940ccdcab1d1d1060c07260fe54

  • SSDEEP

    49152:aWluOKJkZt0J4Nsf0wZXeFen4ELmCdcwV0mqsu2sNf5:aGELDV0cuz

  Score

  10^/10

  meduzacollectiondiscoverystealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2