Extracted

• • Target

    2024-11-23_3f6b461548bdf92e28da68177b1c6e5c_ryuk

  • Size

    4.1MB

  • MD5

    3f6b461548bdf92e28da68177b1c6e5c

  • SHA1

    6f8d46823ac5710ba74f5e9f90429dd64ae792f3

  • SHA256

    cc332b2b190d6bed3bfccf6f7b878a2065cf70babd1cc79a65b7adeadf130323

  • SHA512

    2a8c3421b7c5f718077efe03970de7e716eceffeea39df6b5e4cdf6d8468b896a60b6842d8d174cdc96e58a372b3cbfd07fedcb308f9348a6860e441c72bb88f

  • SSDEEP

    49152:Xl4UjB0jUuCPKPjJKq5q4ifpH2dqbIKL0fvDF+dTUKPLHA:14UjKgusA

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2