Extracted

• • Target

    Xeno.exe

  • Size

    639.6MB

  • MD5

    6b56b5e2d7632106dad7dc81fcac586c

  • SHA1

    7baf24ad92af7dcb89815c87cba15f5eefc5a2a0

  • SHA256

    a4bbf329bf0d63403f9c3cf18118e0b6e8a2401196f1ce497f06efb8b763bb80

  • SHA512

    f15e378acf53fb773c07e0eb7e1a0d3b7dd9503ab7880c788044e523059533cf1b556e742b3f07287a0c4dab1137a2b208f43f2731a36c593b5cefd45cf8c1c5

  • SSDEEP

    49152:W57FKBSfs5YFrkVL8Atdh9EO8fGP1LWAK8FbeL3fzWSjZ+wC:W57FKBSfaYFYL8AnEOp0ATbeLvam4w

  Score

  10^/10

  meduzacollectiondiscoveryspywarestealer

  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

    stealermeduza

  • Meduza Stealer payload

  • Meduza family

    meduza

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1