Extracted

• • Target

    Kraken.exe

  • Size

    3.7MB

  • MD5

    2efb1d6f632c13e3be57d710f190f8d0

  • SHA1

    19437cafa11c6ae5fa27e35de3369cf0817a7dbb

  • SHA256

    ca54bdbbd6238be2040eb965561f078e573569d8d2fa0756d02e2795276c62bf

  • SHA512

    ae3a3fa1c142c5d57f641da0941364189ffe01daac6a4739d5d84508f0461451ef4c818cc1164d9cfab3ddbc6f613f94e26046fd7d613e42a7ec858dec29b38b

  • SSDEEP

    49152:PQusxfstVERf60TI/s4U/cAjuvWjbQVLu3:gCu3

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1