Extracted

• • Target

    573a8b074dcf83020f19c09d697713fa3523ae8ad2f086ed0949ccbd6a5fbede.exe

  • Size

    4.1MB

  • MD5

    564cd70f231e24a29ca5ac7338ff5f01

  • SHA1

    4e1cea2817e2efcb1336e87c309b7a022b139e99

  • SHA256

    573a8b074dcf83020f19c09d697713fa3523ae8ad2f086ed0949ccbd6a5fbede

  • SHA512

    c07c7c5d3e7d264efa630b55504bccfcae57b4a4c11f7fc78021e25c394b43d13977cbea38c03af7540aa8a8070ef944aa1a176c390de213a688943399b29717

  • SSDEEP

    49152:/xGK0l3e3ubXWCC5JJhZs0wFF2d1vJ2Z5:/xGK09yuZZ5

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2