Extracted

• • Target

    2024-11-21_a88a7848a66a3ab2018b141b43f7d22d_ryuk

  • Size

    4.1MB

  • MD5

    a88a7848a66a3ab2018b141b43f7d22d

  • SHA1

    d6c8775d28f6e2428a5ddc75276cf8f7a3358ca4

  • SHA256

    f58f565ea57ad0e9790bc776ec1b2a8d891065a237b55205c3e94c64ce8868fa

  • SHA512

    fcc6df54d9d314cd8486c5b72d1e0246822b3637fdb50dfcdab8b65ee78d532deffa19eba26c1051ab825441a3debc0a590532924384e848699d9e54649c734b

  • SSDEEP

    49152:/xGK0l3e3u5dhCjuv3nZpWY6eKsHolcvyNCkgk0Z:/xGK09yu9Z

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2